The vulnerability resides in the Server Infrastructure component of Oracle's Siebel CRM Deployment and permits a remote, unauthenticated attacker with HTTP network access to compromise the system. Successful exploitation can lead to unauthorized disclosure of critical data and supports unauthorized insert, update or delete operations on the data accessible through the deployment. The flaw results in high confidentiality impact and lower integrity impact, with no availability effect.

Affected vendor and product: Oracle Corporation’s Siebel CRM Deployment. Versions ranging from 17.0 through 26.9 are impacted. These versions provide the deployment platform for the CRM system and are commonly deployed in enterprise environments that rely on web interfaces for data management.

The vulnerability carries a CVSS v3.1 base score of 8.2 reflecting a severe risk. EPSS is not available, and the vulnerability is not yet listed in CISA’s KEV catalog. Attackers can reach the target over the network via HTTP, implying network attack vector. Given the high confidentiality impact and the lack of requirement for authentication, the exploitation risk remains substantial while the absence of a public exploit reduces the current threat intensity slightly.