A configuration management flaw in Oracle Enterprise Manager for Siebel allows a low‑privileged attacker with network access over HTTP to compromise the system. The vulnerability is easily exploitable, enabling the attacker to gain full control of the application, resulting in a complete takeover. This impacts confidentiality, integrity, and availability, exposing sensitive data, allowing unauthorized changes, and potentially disrupting service.

Affected systems are Oracle Enterprise Manager for Siebel version 13.5 and 24.1. Any deployment of these versions without the appropriate security update is susceptible to the described exploitation.

Risk and exploitability are high: the CVSS v3.1 score of 8.8 classifies this as a high‑severity vulnerability, and the absence of an EPSS score does not reduce the likelihood of exploitation in a networked environment. The vulnerability is not yet listed in the CISA KEV catalog, but its remote and low‑privilege attack vector—attacker can initiate a request over HTTP from any reachable host—makes it a prime target for adversaries with network presence.