The vulnerability in Siebel Apps – Marketing exposes an HTTP endpoint that, without authentication, permits an attacker to alter, insert or delete data and to read specific data items. The impact is a decrease in data confidentiality and integrity for the affected system. The description indicates that a human interaction from a person other than the attacker is required to complete the attack, but the presence of an unauthenticated entry point makes the risk significant if an attacker can coerce or impersonate a user.

Oracle Corporation’s Siebel Apps – Marketing for all supported versions from 17.0 through 26.9 is affected. The product is part of the Oracle Siebel CRM suite, and while the flaw is contained in the Marketing component, successful exploitation could extend to other related modules, expanding the attack scope.

The CVSS 3.1 score of 6.1 reflects a medium risk with low complexity, no privileged access, and user interaction. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting that it may not yet have widespread public exploitation. The likely attack vector is network-based HTTP, and the required human interaction reduces the immediate threat but does not eliminate risk, particularly if social engineering succeeds or automated phishing is used.