A vulnerability exists in the Siebel CRM End User product (component: Open UI) affecting versions 17.0 through 26.7. This vulnerability allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical data and perform unauthorized update, insert, or delete operations on some accessible data. The CVSS 3.1 base score is 7.1, indicating a high severity with significant confidentiality and integrity impacts but no availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update.