A vulnerability in Oracle Siebel CRM Development’s Siebel Approval Manager component allows an unauthenticated attacker with network access via HTTP to compromise the system. The flaw requires the attacker’s action to be performed by a user other than the attacker; when the user interacts with the exposed UI, the attacker can take full control of the application. The impact is complete compromise, affecting confidentiality, integrity, and availability, as reflected in the CVSS 3.1 score of 8.8. The weakness is a Cross Site Request Forgery (CWE‑352) that permits the attacker to trigger privileged actions on behalf of another user. Successful exploitation can lead to a full takeover of the target instance.

Oracle Corporation’s Siebel CRM Development product, versions 17.0 up to 26.9, are affected. The vulnerability is specific to the Siebel Approval Manager component and can be triggered by any HTTP‑enabled endpoint exposed to the network. No other vendor or product is listed as affected.

The CVSS base score of 8.8 indicates a high‑impact flaw, and while the EPSS score is < 1%, the lack of a known exploit does not diminish the risk; the vulnerability is easily exploitable once the user is compelled to interact with the affected interface. It is not listed in the CISA KEV catalog, but the high severity and potential for remote takeover warrant immediate attention. Attackers would typically rely on phishing, social engineering, or benign‑looking administrative actions to lure a user into interacting with the vulnerable UI over a network‑accessible HTTP connection, thereby exploiting the Cross Site Request Forgery (CWE‑352) weakness. The successful exploitation would grant the attacker high privileges over the Siebel CRM Development instance.