The vulnerability resides in the Siebel CRM Integration component Open Integration. An unauthenticated network user can gain access over HTTP and, with user interaction from a person other than the attacker, can perform unauthorized updates, inserts, deletes, and read operations on data exposed by the integration. The weakness permits confidentiality and integrity compromise on a subset of data, which aligns with the CVSS 3.1 metrics of low to moderate impact.

Affected systems are Oracle Siebel CRM Integration, specifically the Oracle Siebel CRM product running Open Integration component. The vulnerability applies to supported versions 25.12 through 26.9 for this integration service.

The CVSS base score is 4.7 and no EPSS data is available; the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an unauthenticated attacker, but succeeds only when a separate user interacts with the system, reducing ease of attack. The network-based HTTP vector and lack of required credentials mean that exposure over the network can allow an attacker to modify or read data within the integration. The scope change indicates that while the flaw originates in Siebel CRM Integration, other interconnected products might experience similar effects if they rely on the integration service.