This vulnerability resides in the Server Infrastructure component of Oracle Siebel CRM Deployment. A low‑privileged attacker who can reach the HTTP interface may exploit the flaw to gain unauthorized access to critical data or even all data that the deployed system exposes. The impact is primarily confidentiality, as the attacker can read data beyond their permissions. The CVSS 3.1 vector indicates a network attack with low access complexity and low privilege requirement, underscoring the ease with which an exploit could be performed.

Oracle Corporation’s Siebel CRM Deployment product, versions 17.0 through 26.9 inclusive, is affected. Users running any of these releases should refer to Oracle’s security advisories for patching guidance.

The CVSS base score of 6.5 places this as a moderate‑to‑high risk vulnerability. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Because the attack vector is network‑based via HTTP with a low privilege requirement, the exploitability is considered high in environments where the deployment is exposed to untrusted networks. An attacker typically needs only the ability to send HTTP requests; no credentials or privileged access is required to achieve the unauthorized data exposure described.