The vulnerability allows an unauthenticated attacker who can reach the Siebel CRM Deployment server over HTTP to read sensitive data stored in the system. According to the CVSS vector, the impact is exclusively on confidentiality, with no integrity or availability effects. The flaw enables the attacker to bypass any authentication controls that normally restrict access to the system’s data, potentially exposing critical business information. The vulnerability is not mitigated by any input validation or error handling, making it straightforward to exploit if the server is reachable.

Oracle Siebel CRM Deployment, version 17.0 through 26.9, specifically the Server Infrastructure component. Any deployment of these versions that remains on the network without further protection is susceptible.

The CVSS v3.1 base score of 7.5 indicates a high severity and the vulnerability is easily exploitable, requiring only network access to the HTTP interface. The EPSS score is not available, but the lack of a requirement for special privileges or involving complex conditions suggests a high likelihood that an attacker could practice the exploit. The vulnerability is not listed in the CISA KEV catalog, yet its unconstrained access model and high confidentiality impact make it a top priority for mitigation. The attack vector is inferred to be static HTTP over the network, with no user interaction or privilege escalation needed.