This vulnerability in Oracle Siebel CRM Integration’s REST component allows a low‑privileged attacker with network access via HTTP to compromise the system. Exploitation can lead to full takeover of the application, resulting in severe confidentiality, integrity, and availability impacts. The flaw is difficult to exploit due to the need for minimal privileges, but once achieved it provides unrestricted access to sensitive data and control of the CRM integration services.

Affected versions of Oracle Siebel CRM Integration range from 17.0 through 26.6. All deployments that include the REST component are potentially vulnerable, and the issue may also extend to additional products when the scope changes.

The CVSS score of 8.5 indicates high severity. The EPSS score is < 1%, signifying a very low exploitation probability, but the potential impact remains critical. The vulnerability is not listed in CISA KEV. Because a low‑privilege attacker can reach the REST endpoint over HTTP without user interaction, the attack surface is widespread in environments that expose Siebel CRM Integration to the network. Any successful exploitation could lead to complete takeover of the application.