A local, unauthenticated attacker who can log onto the infrastructure that hosts the Oracle Siebel Marketing application can exploit a vulnerability in the Marketing component. The flaw enables the attacker to cause a partial denial of service, degrading the availability of the Siebel Marketing service. The weakness is a denial of service type that leaves confidentiality and integrity untouched.

Oracle Corporation’s Siebel Apps – Marketing product is affected. Versions from 17.0 through 26.9 are vulnerable. The vulnerability specifically targets the Marketing component of the Siebel CRM suite.

The CVSS score of 2.9 reflects a low to moderate severity with a focus on availability. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, indicating limited evidence of exploitation. The attack vector is local (AV:L); an attacker needs to be able to log on to the infrastructure where Siebel Marketing runs. Once exploited, the attacker can interrupt or disrupt service, potentially causing business impact in environments where Siebel Marketing is critical.