A vulnerability has been identified in the Server Infrastructure component of Oracle Siebel CRM Deployment that allows an unauthenticated attacker to gain read access to critical data over an encrypted network connection. The flaw arises from improper access control mechanisms, allowing a remote adversary to bypass authentication and read any data stored within the system. The exposure of sensitive information can lead to significant confidentiality loss for organizations that rely on Siebel CRM for customer relationship management.

Oracle Corporation's Siebel CRM Deployment product is affected, specifically versions ranging from 17.0 up to 26.9. The vulnerability is present in all builds within this range and affects the Server Infrastructure component of the application.

The vulnerability is rated 7.5 on the CVSS 3.1 scale and is considered exploitable without additional credentials, only requiring network access via TLS. The absence of an EPSS score limits precise exploitation probability assessment, and it is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not yet been reported. Nonetheless, the potential for unauthorized data access warrants immediate attention, as an attacker can compromise the confidentiality of all data accessible through Siebel CRM Deployment.