This vulnerability allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to Oracle Siebel CRM Deployment. Successful exploitation can compromise all data exposed by the deployment, potentially exposing critical business information. The weakness is an authentication bypass, as reflected by the CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N and the resulting high confidentiality impact.

Oracle Corporation’s Siebel CRM Deployment product, versions 17.0 through 26.9, are affected. The flaw resides in the Server Infrastructure component of the deployment stack.

The CVSS base score is 7.5, indicating a high‑severity vulnerability. The EPSS score is 0.00398 (less than 1 %), indicating a very low probability of exploitation. The flaw is not listed in CISA’s KEV catalogue. The attack vector is inferred to be over unsecured HTTP, requiring no authentication or special user privileges. An attacker can send crafted requests directly to the vulnerable endpoint, achieving control over sensitive data or complete system access.