The vulnerability in Oracle Siebel CRM's Customer Order Management (versions 17.0-26.7) permits a low privileged attacker with network access via HTTP to compromise the component. Exploitation requires user interaction from a person other than the attacker and can result in unauthorized creation, deletion, or modification of critical data, impacting confidentiality and integrity. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N with a base score of 8.7. Oracle has included this fix in its September 2026 Critical Security Patch Update, which addresses this and many other vulnerabilities across Oracle products.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within the Siebel Apps - Customer Order Management component. The vulnerability impacts confidentiality and integrity severely but does not affect availability. The scope of impact may extend beyond the immediate component to additional products. The CVSS score of 8.7 reflects a high-severity vulnerability requiring user interaction and low attack complexity.

Oracle has released a security patch for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the provided patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified by Oracle.