Oracle Siebel Apps – Marketing contains a vulnerability that permits an attacker with high privileges to read a subset of data that should be protected. The flaw manifests over the network via HTTP and does not lead to code execution, denial of service, or other disruptive effects. It is a low‑severity defect with a CVSS 3.1 Base Score of 2.2, indicating limited impact focused on confidentiality.

Oracle Corporation’s Siebel Apps – Marketing version 17.0 through 26.9 are affected. All deployments of the Marketing component in those releases are vulnerable.

The CVSS vector AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N characterizes the attack as high‑privilege network use. An attacker must already possess a high‑privileged account and be able to reach the application over HTTP. Because EPSS is not available and the vulnerability is not listed in CISA KEV, the likelihood of widespread exploitation is low, yet an internal threat actor could potentially abuse the weakness to gain unauthorized read access. The risk is best described as moderate for environments with high‐privilege users and exposed HTTP endpoints.