An attacker who can reach the Siebel CRM End User over HTTP can exploit a flaw in the UIF Open UI component without prior authentication. The vulnerability enables the attacker to read sensitive data, potentially encompassing all data exposed through the application. While integrity and availability are not directly affected, the high confidentiality impact means critical business information could be leaked or accessed by unauthorized parties.

Oracle Siebel CRM End User, versions 17.0 through 26.9, is vulnerable. All customers running any of these releases should be aware that the vulnerability exists until a patch is applied.

The CVSS score of 7.5 classifies this as a high‑severity risk. No EPSS value is published, and the vulnerability is not yet listed in the CISA Known Exploited Vulnerabilities catalog, but the attack vector is network and unauthenticated, making exploitation practical. Because the flaw is easily exploitable with regular HTTP traffic and does not require privileged credentials, it presents a serious threat to data confidentiality.