The vulnerability exists in the Communications Panel/Dashboard component of Siebel CRM End User and permits an unauthenticated attacker to gain unauthorized access to critical data, as well as to update, insert, or delete data normally accessible through the end user interface. The impact includes both confidentiality and integrity damage, with a CVSS 3.1 Base Score of 8.2 indicating high severity. Only an accidental or malicious disclosure of data would occur from the confidentiality side, while the integrity impact involves modification or deletion of data entries, potentially compromising business operations and client records.

Oracle Siebel CRM End User is affected in all supported versions from 17.0 through 26.9. The CVE applies specifically to the Communications Panel/Dashboard component offered by Oracle Corporation.

The CVSS score of 8.2 reflects the vulnerability’s importance, while the EPSS score is < 1%, indicating a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via an unauthenticated HTTP request directed at the vulnerable endpoint; this is inferred from the description that mentions network access over HTTP. Given the lack of need for authentication, exploitation probability depends largely on whether the vulnerable endpoint is exposed to the internet or an untrusted internal network. In a scenario where the endpoint is reachable, an attacker could achieve full read, update, insert, or delete access to all data exposed through the end user interface.