A vulnerability in Oracle Siebel CRM Marketing enables an unauthenticated attacker who can reach the application through HTTP to compromise data integrity by performing unauthorized update, insert or delete operations on the application’s accessible data. The weakness is a missing authorization flaw that allows a user without authentication to gain write privileges, requiring only simple network connectivity and some degree of user interaction from a person other than the attacker. The CVSS 3.1 vector shows the attack is network reachable, low complexity, with no privileges and user interaction required, and the impact is limited to integrity.

The affected product is Oracle Siebel CRM – Marketing, versions 17.0 through 26.9. Any deployment of these versions that exposes HTTP endpoints to the network is vulnerable and subject to unauthorized modification of marketing data.

The CVSS base score of 4.3 indicates low severity with a focus on integrity. The EPSS score is 0.0028 (< 1%) and the vulnerability is not listed in CISA KEV. Because it requires human interaction from a person other than the attacker, the exploit requires social engineering or insider assistance; however, an attacker can exploit the flaw remotely once target access is established. The overall risk is low, but organizations should treat it as a potential data integrity threat until a patch is applied.