A flaw in the Financial Accounts component of Siebel Apps – Financial Services allows an unauthenticated attacker who can reach the application via HTTP to bypass authentication and gain read and write access to data exposed by the module. The vulnerability can lead to the disclosure of confidential information and alteration of records, resulting in confidentiality and integrity damage.

Oracle Corporation’s Siebel Apps – Financial Services, versions 17.0 through 26.9, are impacted by this vulnerability.

The CVSS 3.1 base score of 6.5 places the issue in the medium range; the attack vector is network-based and constrained to HTTP access, which raises the effort required for exploitation. The EPSS score is reported as < 1%, indicating a very low probability of active exploitation at this time, and the vulnerability is not listed in CISA’s KEV catalog. In practice, an attacker with network reach to the application would need to craft a specialized HTTP request to trigger the flaw. Once triggered, the attacker can read or modify any data that the application makes available to the Financial Accounts module, potentially compromising the confidentiality and integrity of sensitive financial information.