The vulnerability is an access‑control flaw that allows a high privileged attacker who can reach the application over HTTP to modify, delete, or create data within the Siebel CRM Deployment product. The flaw enables the attacker to read or alter confidential data, resulting in both confidentiality and integrity impacts. The CVSS 3.1 vector indicates the attack is network based with low complexity and high privilege requirements, and the scope changes from user to all data, yielding a high Base Score of 8.7.

Oracle Siebel CRM Deployment is affected. Supported affected versions range from 17.0 through 26.9. The product is deployed as part of the Oracle Siebel CRM suite on servers exposed to HTTP traffic.

The vulnerability’s CVSS score of 8.7 reflects significant risk: attackers with network access can compromise data integrity and confidentiality. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, but the high base score and scope change suggest the potential for serious exploitation. Attackers would likely initiate requests over HTTP against the vulnerable endpoint, leveraging their existing high-level credentials to exploit the flaw. Because the vulnerability affects an exposed interface, the likelihood of exploitation remains high if privileged credentials are compromised or if the attacker can gain initial access.