This vulnerability affects the Siebel CRM End User "Open UI" component and allows an unauthenticated attacker with network access via HTTP to compromise the application. Successful exploitation requires human interaction from a person other than the attacker. If triggered, the attacker can obtain unauthorized update, insert, or delete access to data that the user can normally view or modify, thereby compromising data integrity. The CVSS base score is 4.3, reflecting moderate risk with a low complexity and a requirement for user interaction.

Oracle Siebel CRM End User product "Open UI", versions 17.0 through 26.9 are affected.

The vulnerability carries a CVSS 3.1 base score of 4.3, indicating moderate severity. The attack vector is network-based with low complexity. User interaction is required, which suggests social engineering of a legitimate user as the primary path to exploitation. No publicly documented exploits are available and the EPSS score is 0.00213, which is less than 1% and indicates a low probability of exploitation, but the vulnerability is not listed in the CISA KEV catalog. Because it permits unauthorized data modification, it poses a real risk to integrity and should be addressed promptly.