The vulnerability in Oracle Siebel CRM Deployment allows an attacker with low privileges and network access to the HTTP interface to gain unauthorized access to critical data and, in some cases, to modify or delete that data. This results in high confidentiality impact and a low but non‑zero integrity impact, as outlined by the CVSS 3.1 vector.

Affected are all Oracle Siebel CRM Deployment releases from version 17.0 up to, but not including, 27.0. The product is provided by Oracle Corporation and contains a Server Infrastructure component that is susceptible to the described exploitation path.

The CVSS 3.1 base score of 7.1 reflects moderate to high severity, with a network attack vector, low privilege requirement, and no user interaction needed. The EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, indicating that public exploitation is not confirmed but the ease of exploitation via HTTP remains a tangible risk to any organization still running susceptible versions.