The flaw resides in the Server Infrastructure component of Oracle Siebel CRM Deployment and permits an unauthenticated attacker with network connectivity to the HTTP interface to compromise the application. Successful exploitation can lead to unauthorized disclosure of confidential data or full access to all data stored in the deployment. The CVSS v3.1 vector indicates a high confidentiality impact. The attack requires a human assistant to provide information or credentials that the attacker does not possess, but the initial attack vector does not require elevated privileges. The vulnerability results from insufficient controls that fail to verify the authenticity of the HTTP requests.

Oracle Siebel CRM Deployment (Server Infrastructure) versions 17.0 through 26.9 are affected. Users deploying any of these releases should verify their installed version against the affected range and ensure that their environment matches the product identifier indicated by the CPE string.

The CVSS base score of 5.3 reflects moderate severity, with network access required but high attack complexity, no privilege escalation, and no user interface interaction beyond initial human assistance. Because the EPSS score is not available, current exploitation probability cannot be quantified, and the vulnerability is not listed in CISA KEV at this time. However, the presence of a network-facing entry point and the potential for full data compromise warrant attention, particularly in environments where the Siebel CRM Deployment is exposed to external networks or where data confidentiality is critical.