The vulnerability resides in the Siebel Management Console component of Oracle Siebel CRM Deployment. An unauthenticated attacker with network access to the web interface can retrieve information that is normally restricted to logged‑in users. The flaw provides a low confidentiality impact and does not allow modifications, code execution, or denial of service; it simply permits the disclosure of a subset of deployment‑level data.

Oracle Siebel CRM Deployment versions 17.0 through 26.9 include the vulnerable Siebel Management Console component. These builds expose HTTP endpoints that can be accessed publicly over the network.

The CVSS 3.1 vector indicates a network‑based attack with low complexity and no privileges required, yielding a Base Score of 5.3. The EPSS score is less than 1 %, and the vulnerability is not listed in CISA’s KEV catalog. An attacker can achieve the unauthorized read by issuing standard HTTP requests to the exposed console URLs. Because the flaw allows improper access control and information disclosure (CWE‑200), it should be treated as a legitimate threat.