A vulnerability in Oracle Siebel CRM’s Siebel Apps – Marketing component permits an attacker with low privileges who can reach the system over HTTP to compromise the application. The flaw can lead to a full takeover, affecting confidentiality, integrity, and availability of the CRM data. The vulnerability is formally rated with a CVSS 3.1 base score of 8.8 and exploits a weakness that allows bypassing normal access controls, aligning with CWE‑284.

The affected product is Oracle’s Siebel Apps – Marketing, supported versions 17.0 through 26.5. Systems running any of these releases and exposed to HTTP traffic on the network are susceptible. No other vendors or products are listed as impacted.

The CVSS score indicates a high severity. The EPSS score of less than 1% suggests that exploitation is currently rare, but the lack of a known KEV listing does not change the fact that an attacker could gain complete control of the application if the vulnerability is discovered and exploited. The attack vector is inferred to be remote over HTTP, requiring only network access and a low level of privileges. An attacker could exploit the flaw by sending specially crafted requests to the Marketing component and bypass authentication to execute arbitrary code or obtain full administrative rights.