The flaw is located in the Marketing component of Oracle Siebel Apps. An attacker who does not possess credentials can interact with the application over HTTP and exploit the vulnerability, causing a full takeover of the Siebel Marketing instance. Because the attack bypasses authentication and is delivered over a standard network protocol, once the flaw is triggered the attacker gains control over the application’s confidentiality, integrity, and availability. The CVSS vector indicates a low attack complexity and no user interaction, underscoring the severity of the impact.

Oracle Corporation’s Siebel Apps – Marketing product is affected in all supported versions from 17.0 through 26.5. The vulnerability applies to any deployment of these releases that is exposed to HTTP traffic.

The vulnerability has a CVSS 3.1 base score of 9.8, reflecting a critical security risk. The EPSS score is reported as less than 1%, suggesting that current exploitation rates are low, but this does not diminish the potential damage should an attacker find a way to reach the target. The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, but attackers could still leverage publicly available code once the environment is identified. Exploitation requires only unauthenticated access via HTTP, making the barrier for an attacker minimal.