A weakness in the Cloud Gateway component of Oracle Siebel CRM Deployment allows an unauthenticated attacker to reach the system over HTTP and retrieve data without needing valid credentials. The flaw is essentially an improper access control issue that lets the attacker view or copy any data the deployment has access to, leading to a confidentiality breach. The vulnerability can be exploited without any local privileges and does not require exploitation of other system components.

Oracle Siebel CRM Deployment, Cloud Gateway component, affected versions 17.0 through 26.9.

The vulnerability received a CVSS v3.1 base score of 7.5, indicating high severity for confidentiality impact. No EPSS score is available, and the issue is not listed in CISA’s KEV catalog, yet the conditions for exploitation are simple: open network access to HTTP. Attackers can immediately exploit the flaw from any network location with HTTP reachability, making the risk high for any environment exposing the Cloud Gateway openly. Maintaining current patches and limiting network exposure are therefore critical.