The vulnerability is an unauthenticated access flaw in Oracle Siebel Apps – Marketing, allowing an attacker with network reach over HTTPS to obtain read, insert, update, or delete privileges on Marketing data. The flaw can compromise the confidentiality and integrity of sensitive customer information. The CVSS vector indicates network access, high attack complexity, and no privileges or user interaction required, resulting in a moderate base score of 4.8.

All Oracle Siebel CRM Marketing versions from 17.0 through 26.9 are affected. Oracle lists the product as Siebel Apps – Marketing, part of the Siebel CRM suite. No further subcomponent or build details are provided in the advisory.

The CVSS base score of 4.8 denotes moderate risk, with impacts to confidentiality and integrity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Successful exploitation requires an unauthenticated client to send a crafted HTTPS request to the Siebel Marketing service; because the attack complexity is high and no privileges are required, the exploit is considered difficult, and no publicly known exploit code is available at present.