The vulnerability in Oracle Siebel CRM Deployment’s Server Infrastructure component permits an unauthenticated attacker to gain unauthorized access to critical data and perform insert, update, or delete operations on accessible data. This results in both confidentiality and integrity impacts as the attacker can read sensitive information and modify or destroy it.

Affected versions of Oracle Siebel CRM Deployment span from 17.0 through 26.9. The vulnerability is exploitable via network access over HTTP and does not require any user interaction or special account credentials.

The CVSS 3.1 base score of 6.5 reflects an impact on confidentiality and integrity with a high attack complexity and no required privileges. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is network-based over HTTP, enabling a remote attacker to exploit the flaw without authentication.