The vulnerability in Siebel Apps – Customer Order Management lets a low‑privilege attacker with HTTP network access exploit a flaw that can lead to unauthorized creation, modification, or deletion of critical data. The flaw requires the attacker to trigger user interaction from an unrelated human, implying a social‑engineering component, but it can still result in significant confidentiality and as indicated by the CVSS vector, is network‑based, low complexity, and low privilege, with scope change enabling the compromise to affect additional Oracle Siebel products beyond the original target.

Oracle’s Siebel CRM product, specifically the Customer Order Management component, is affected in versions 17.0 through 26.7. These versions Oracle security advisory, which does not provide a published patch at the time of this writing.

The CVSS v3.1 base score of 8.7 reflects high confidentiality and integrity impact. EPSS indicates a very low probability of exploitation (<1%), and the vulnerability is not yet listed in CISA’s KEV catalog, suggesting it is not widely exploited currently. Nevertheless, the scope change, the requirement for user interaction, and the high impact make it a serious risk for organizations that run the affected Siebel versions, especially if they expose the applications over HTTP to the internet or untrusted networks.