A vulnerability in Oracle Siebel CRM Development’s Siebel Approval Manager component allows an unauthenticated attacker with network access via HTTP to compromise the system. The flaw requires the attacker’s action to be performed by a user other than the attacker; when the user interacts with the exposed UI, the attacker can take full control of the application. The impact is complete compromise, affecting confidentiality, integrity, and availability, as reflected in the CVSS 3.1 score of 8.8. The weakness aligns with improper access control mechanisms, which is consistent with CWE-284 and CWE-285. Successful exploitation can lead to a full takeover of the target instance.

Oracle Corporation’s Siebel CRM Development product, versions 17.0 up to 26.9, are affected. The vulnerability is specific to the Siebel Approval Manager component and can be triggered by any HTTP-enabled endpoint exposed to the network. No other vendor or product is listed as affected.

The CVSS base score of 8.8 indicates a high-impact flaw, and while an EPSS score is not available, the lack of a known exploit does not diminish the risk; the vulnerability is easily exploitable once the user is compelled to interact with the affected interface. It is not listed in the CISA KEV catalog, but the high severity and potential for remote takeover warrant immediate attention. Attackers would typically rely on phishing, social engineering, or benign-looking administrative actions to lure a user into interacting with the vulnerable UI over a network-accessible HTTP connection. The successful exploitation would grant attacker high privileges over the Siebel CRM Development instance.