A local vulnerability in the Oracle Siebel Marketing component permits a low-privileged attacker who can log onto the infrastructure hosting the application to compromise the Siebel Marketing process. Successful exploitation can lead to unauthorized access to critical data, potentially exposing sensitive customer or marketing information. The flaw is classified as a confidentiality-only impact with a CVSS base score of 5.5.

The vulnerability affects the Oracle Siebel Marketing application, versions ranging from 17.0 through 26.9, as part of the Oracle Siebel CRM suite.

The CVSS 3.1 score of 5.5 indicates moderate severity. Exposure is limited to local attackers with some host access and requires no network connectivity. The EPSS score of < 1% and the fact that the issue is not tracked in the CISA KEV catalog suggest a low probability of exploitation, though the risk remains for environments that allow broad local access. The attack can be carried out by any user who can log into the underlying infrastructure, making the risk significant for such environments. Based on the description, it is inferred that the likely attack vector is local and requires legitimate logon to the host.