Vulnerability in the Workflow component of Oracle Siebel CRM Development allows an attacker with low privileges and HTTP network access to compromise the application. Successful exploitation requires the cooperation of a non‑attacker user, after which the attacker can take full control of the system, enabling unauthorized data disclosure, modification, and service disruption. This flaw has full confidentiality, integrity, and availability impact.

Oracle Corporation’s Siebel CRM Development product, specifically versions 25.12 through 26.9, is impacted. The vulnerability resides in the Workflow component and applies to installations deployed with those version ranges.

The likely attack vector is HTTP network access requiring user interaction (inferred from the description). The CVSS v3.1 base score of 7.1 indicates a high severity, with full confidentiality, integrity, and availability impact. The EPSS score is < 1%, indicating a very low but nonzero likelihood of exploitation, and it is not listed in CISA’s KEV catalog. Attackers are likely to target the application over HTTP from the network, leveraging the need for user interaction to complete the takeover. Given the potential for complete system compromise, the risk is significant for organizations running the affected versions without applying the vendor’s fix.