The vulnerability resides in the Siebel Management Console of Oracle Siebel CRM Deployment and permits an attacker with physical access to read a subset of data stored within the system. The weakness results in a confidentiality impact only, as the attacker can obtain information but cannot modify or delete it. The CVSS 3.1 base score of 2.4 reflects this limited but potentially valuable data exposure.

Oracle Corporation's Siebel CRM Deployment (Siebel Management Console) is affected. Supported versions that are impacted span from 17.0 through 26.9. Any deployment of these versions on a physical machine where the attacker can gain direct access is vulnerable.

The CVSS score indicates low severity, but the EPSS score of 0.00189 indicates a very low probability of exploitation. While there is no KEV listing, the lack of mass exploitation is noted. Nevertheless, the required attack vector is physical access (AV:P), which is difficult for remote attackers. In an environment where physical security controls are inadequate, a malicious insider or delivery‑person could exploit the flaw to read sensitive data without executing code or compromising system availability.