Oracle Siebel CRM Deployment’s Server Infrastructure component contains a flaw that allows an attacker who has low privileges and network connectivity via HTTP to create, delete, or modify critical data. The vulnerability does not expose data directly, but it enables the attacker to alter data or system state that is otherwise protected, resulting in integrity compromise of the application.

The impact applies to Oracle Siebel CRM Deployment, versions 17.0 through 26.9 inclusive. Users running any of these versions are at risk if the vulnerable component is exposed to HTTP traffic.

The CVSS 3.1 base score of 5.3 reflects moderate severity with a high attack complexity and low privileges required. Because the attack vector is network-based and requires a low-privileged user, exploitation is feasible over the public network. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting it is not part of a current known attack wave. Nonetheless, the ability to alter critical data justifies timely mitigation.