A flaw in the Siebel CRM Deployment Server Infrastructure permits an unauthenticated attacker to issue HTTP requests that bypass authentication, allowing the creation, deletion, or modification of critical data. The vulnerability compromises confidentiality and integrity by enabling unauthorized access and data tampering without credentials.

Oracle Siebel CRM Deployment by Oracle Corporation is impacted. Version numbers from 17.0 up through 26.9 are susceptible. The flaw resides in the Server Infrastructure component of the product.

The CVSS v3.1 base score is 7.4, indicating significant confidentiality and integrity impact. The EPSS score of less than 1% suggests a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the weakness by sending specially crafted HTTP requests over the network; no authentication is required, so any host with network reachability to the Siebel CRM Deployment HTTP endpoints is at risk. Because the vulnerability does not affect availability, the exploit primarily targets data integrity.