The vulnerability lies in the Siebel CRM Integration’s HTTP endpoints, which lack proper authentication, allowing an unauthenticated attacker to read or modify critical data. This results in confidentiality loss and integrity compromise, matching CWE-200. Successful exploitation grants the attacker unrestricted access to all data exposed by the integration and can extend to other connected products due to the scope change noted in the advisory.

Oracle Siebel CRM Integration, versions 17.0 through 26.9, is the sole product cited as affected. The impact may cascade to additional products that interact with the integration because of a scope change.

The CVSS 3.1 base score of 6.9 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires unauthenticated HTTP access and a separate human user at the target, reducing immediate remote attack feasibility but still posing a medium‑to‑high threat for organizations with exposed integration endpoints. The risk is elevated for systems that host the integration and expose its endpoints to the network.