This vulnerability allows an attacker with low privileged credentials and network access via HTTP to create, delete, or modify critical data within the Siebel CRM Deployment. The primary impact is on data integrity, as the attacker can alter or erase information that is normally controlled. The CVSS v3.1 base score of 6.5 underlines a moderate risk level, but the ease of exploitation makes it a significant concern for exposed deployments.

Oracle Corporation’s Siebel CRM Deployment product, covering supported versions 17.0 through 26.9. The flaw resides in the Server Infrastructure component and is triggerable from the public‑facing HTTP interface. Systems that expose this interface without strict network or permission controls are vulnerable.

The vulnerability is classified as easily exploitable by any actor that can reach the HTTP endpoint, with only low privilege required to perform the attack. The EPSS score is < 1%, and the vulnerability is not yet listed in the CISA KEV catalog. Despite the moderate CVSS score, the lack of a defense‑in‑depth check on low‑privilege accounts or network segmentation increases the likelihood of successful exploitation. Monitoring and rapid application of the vendor patch are therefore critical to mitigate potential unauthorized data alterations.