Vulnerability in the Smart Answer component of Oracle Siebel Apps – Field Service enables an attacker with high privileges and network access via HTTP to compromise the application, potentially taking full control. The flaw is easily exploitable and directly impacts confidentiality, integrity, and availability, as indicated by the CVSS 3.1 vector with high impact ratings on all three principles.

The affected product is Oracle Siebel Apps – Field Service, versions 17.0 through 26.9, as listed for the Smart Answer component in the Oracle security alert.

The CVSS base score of 7.2 signals a high severity risk, but the EPSS score is 0.00466 (less than 1%) and the issue is not in the CISA KEV catalog, suggesting limited current exploitation pressure. Attackers would reach the target via HTTP over the network, requiring high privileges to successfully execute the vulnerability, but the low attack complexity means the exploit could be readily automated once the target is identified. The lack of an official workaround means reverse mitigation is primarily through patching and network hardening.