The vulnerability in Oracle Siebel CRM Deployment’s Server Infrastructure allows an unauthenticated attacker to access the application over HTTP, bypassing authentication and gaining unauthorized read access to critical data. This flaw results in a confidentiality breach that could expose sensitive customer information or other critical business data.

The issue affects Oracle Siebel CRM Deployment systems with versions ranging from 17.0 through 26.9. Systems running these releases are susceptible to the data exfiltration risk described above.

The CVSS base score of 7.5 indicates a high impact on confidentiality with no integrity or availability effects. Because the vulnerability is exploitable via a simple HTTP request, an attacker requires only network visibility; no special privileges are necessary. The EPSS score is currently unavailable, and the vulnerability is not yet listed in CISA’s KEV catalog, but the lack of a public exploit does not mitigate the risk, as the flaw is easy to recover. Attackers can execute the exploit remotely, presenting a significant threat to unpatched deployments.