The vulnerability in Oracle Siebel Apps - Marketing permits an attacker with high privileges who has logged onto the underlying infrastructure to change application data by inserting, updating, or deleting records. It also allows the attacker to read sensitive data that should not be exposed, and to cause a partial denial of service for the marketing component. The weakness exposes low severity confidentiality, integrity, and availability impacts, as reflected by the CVSS score of 3.9. Potential gain for the attacker is loss of data control and temporary disruption of marketing operations, but no network‑wide compromise or system takeover is described in the data.

Oracle Corporation Siebel Apps - Marketing versions 17.0 through 26.9 are affected; no specific patch version is listed but all versions in that range are vulnerable.

The CVSS vector indicates local access (AV:L) is required, with high attack complexity and high privilege. Because the exploit requires an attacker to already have high‑privilege access to the host, the exploitation probability is limited to internal or compromised environments. EPSS data is not available, but the lack of external exposure reduces likelihood of use from the internet. The vulnerability is not listed in CISA KEV catalog. Overall risk remains moderate, confined to environments where privileged users can reach the Siebel server.