A vulnerability in the Email Marketing component of Oracle Siebel Apps – Marketing allows an unauthenticated network attacker to gain access over HTTP, but the flaw requires user interaction from a third party. Compromise can result in unauthorized exposure of critical data, complete access to all marketing data, and the ability to update, insert, or delete some records. The impact on confidentiality is high and on integrity is low, with no availability effects.

Oracle Corporation’s Siebel Apps – Marketing, versions 17.0 through 26.9, are affected. No other products or versions are mentioned.

The CVSS 3.1 base score of 5.9 classifies the flaw as medium severity. Exploitation requires user interaction, suggesting a lower likelihood than pure remote exploits. The EPSS score of <1% indicates a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, implying current public exploitation is limited. Nevertheless, an attacker who successfully lures a user into executing the needed action could gain significant data control within the affected application.