The flaw resides in the Siebel Approval Manager component of Oracle Siebel CRM Development and is caused by a missing authentication for a critical function, identified as CWE-306. An unauthenticated attacker who can reach the HTTP interface of the application can exploit the vulnerability to run arbitrary code with the privileges of the Siebel process, thereby corrupting confidential data, altering system state, or rendering the service unavailable. The CVSS v3.1 base score of 9.8 makes the impact critically high for confidentiality, integrity, and availability.

Oracle Corporation’s Siebel CRM Development product, specifically the Siebel Approval Manager component, is impacted. All releases from version 17.0 up through 26.3 are vulnerable if the HTTP endpoint is exposed. Any installation that allows direct HTTP communication to the Siebel server can potentially be exploited.

A CVSS score of 9.8 classifies this vulnerability as Critical. The EPSS score of less than 1 % suggests that real‑world exploitation is currently rare, but because the vulnerability arises from a missing authentication (CWE-306) and relies on normal HTTP traffic, an adversary with network access could still carry out an attack. The lack of a KEV listing offers no additional protection; once the flaw is publicly known, it can be leveraged without credentialing.