This vulnerability in Oracle Siebel Apps – Marketing allows an attacker who is unauthenticated but has network access via HTTP to take control of the application. The issue results in full compromise with confidentiality, integrity, and availability all affected, as a successful exploit can take over the service. The weakness is a lack of proper access control and authentication enforcement.

Oracle Corporation’s Siebel Apps – Marketing, versions 17.0 through 26.5, are impacted. No specific sub‑versions are noted beyond the range, so any build within this span is potentially vulnerable.

The CVSS score of 9.8 indicates critical severity, and the EPSS score shows a very low yet non‑zero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation yet. However, because the attack vector is over a publicly reachable HTTP interface with no authentication required, the risk of exploitation remains high, especially for exposed deployments.