Oracle Siebel CRM Deployment’s Server Infrastructure component contains an easily exploitable weakness that allows a local attacker with high privileged access to compromise the deployment. Successful exploitation can lead to a full takeover of Siebel CRM Deployment, resulting in confidentiality, integrity and availability loss.

Oracle Corporation’s Siebel CRM Deployment product, specifically the Server Infrastructure component, is affected. All versions from 17.0 to 26.9 are vulnerable.

The CVSS 3.1 base score of 6.7 indicates a moderate severity, with local access and low attack complexity required. The vulnerability demands that the attacker already possess high privileges on the infrastructure before exploitation can occur and no user interaction is needed. Because this requires elevated local access, the attack vector is limited to compromised or privileged hosts, and the EPSS score is < 1%. The vulnerability is not listed in the CISA KEV catalog, but the local privilege requirement means that any compromised service account or administrative machine could become a foothold to the Siebel CRM Deployment process.