The vulnerability in Oracle Siebel CRM Cloud Applications allows an attacker who can reach the application over HTTP to perform unauthorized update, insert, or delete actions on data without authentication. This results in integrity impact to the application’s database, but based on the description, it is inferred that it does not directly expose sensitive information or cause service disruption. The weakness is an insufficient authentication check before data modification, reflected in the CVSS 3.1 score of 5.3.

In the affected system, the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications is vulnerable. The product is distributed by Oracle Corporation and is part of the Siebel CRM Cloud Applications suite. Versions 22.3 through 26.9 are affected. All deployments that listen on public HTTP endpoints are potentially exposed if no additional network segmentation or authentication is applied.

The CVSS base score of 5.3 indicates a moderate severity with integrity impact. The EPSS score is not available, so the probability of exploitation cannot be quantified from public data. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no publicly known exploits at the time of this analysis. Based on the description, it is inferred that attackers could leverage the lack of authentication to mutate records, create a denial of service scenario by inflating data, or undermine regulatory compliance. By restricting access to the HTTP interface, applying an available patch, and enforcing proper authentication and authorization controls, administrators can mitigate this risk.