A flaw in Oracle Enterprise Manager for Siebel’s Configuration Management module allows an attacker with low privileges who can reach the system over HTTP to compromise the application. Successful exploitation can result in full takeover of the Enterprise Manager instance, giving the attacker control of configuration data and, potentially, any downstream Siebel services. The vulnerability is a type of unauthorized access weakness, enabling an attacker to bypass security controls.

Oracle Enterprise Manager for Siebel versions 13.5 and 24.1 are affected.

The CVSS v3.1 score of 8.8 denotes a high severity that impacts confidentiality, integrity, and availability. The attack requires only network access over HTTP and low privileges, making it relatively easy to exploit. Though EPSS data is not available, the high CVSS score combined with the lack of a KEV listing suggests that organizations should treat this threat with high importance. While the vulnerability is not presently catalogued by CISA, the combination of severe impacts and easily exploitable conditions means a rapid response is warranted.