This vulnerability in Oracle Siebel CRM Deployment affects versions 17.0 through 26.7 and allows a low privileged attacker with network access via HTTP to compromise the deployment. Successful exploitation can lead to unauthorized access to critical data or complete access to all accessible data within Siebel CRM Deployment, as well as unauthorized modification (update, insert, delete) of some data. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update advisory.

An attacker with low privileges and network access via HTTP can exploit this vulnerability to gain unauthorized access to critical data within the Siebel CRM Deployment environment. This includes potential full access to all accessible data and the ability to perform unauthorized data modifications such as updates, inserts, or deletions on some data. The confidentiality impact is high, and the integrity impact is low, with no availability impact reported.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed as available via the official Oracle advisory at https://www.oracle.com/security-alerts/cspusep2026.html.