A vulnerability in Oracle Siebel Apps – Marketing allows an unauthenticated attacker who has logged onto the infrastructure where the application runs to compromise the application and trigger a partial denial of service. The flaw does not affect confidentiality or integrity, and its CVSS v3.1 base score of 2.9 indicates a low overall severity but it can cause a noticeable interruption in availability for users.

Oracle Siebel Apps – Marketing, versions 17.0 through 26.9, is affected by this vulnerability. Users of these versions should consult the October 2026 Oracle CPUOCT2026 security advisory for information about patches.

The CVSS score of 2.9 reflects the low severity, and the EPSS score is < 1%, indicating a very low probability of exploitation. The vulnerability is not listed in CISA KEV. Attackers must be able to log on to the infrastructure running Siebel Apps – Marketing, limiting the requirement to insiders or compromised environments. Although the flaw is difficult to exploit, the need for infrastructure access reduces the likelihood of widespread attacks.