The vulnerability allows an attacker to perform unauthorized updates, inserts, or deletions of data and read a subset of data within Siebel Apps – Marketing. The impact is limited to confidentiality and integrity and can affect both the Marketing component and potentially other integrated products due to a scope change. The weakness acts via a network entry point and requires the victim to interact with the UI, indicating an absence of privileged access but a reliance on user action.

Oracle Siebel CRM’s Siebel Apps – Marketing product, versions 17.0 through 26.9. The affected component is specifically Marketing.

The CVSS v3.1 base score of 6.1 classifies this as a medium severity flaw. Exploitability is considered easy due to HTTP network exposure but the absence of an automated attack requires human interaction, lowering the practical attack window. The EPSS score is not available, and the flaw is not listed in CISA’s KEV catalog, suggesting a moderate yet noteworthy risk for organizations still running the vulnerable version.