A local, low privileged attacker who has logged into the infrastructure where Oracle Siebel CRM Development runs can exploit a flaw in the Integration – Scripting component, allowing the attacker to create, delete or modify data within the application; this leads to confidentiality and integrity impacts as stated by the CVSS vector. The vulnerability does not directly affect availability and requires no user interaction to succeed.

Oracle Siebel CRM Development, versions 17.0 through 26.9, regardless of platform; all installations that include the Integration – Scripting component are affected.

The CVSS score of 6.3 indicates moderate severity; the EPSS score is not available, so the quantified likelihood of exploitation is unknown, and the vulnerability is not listed in the CISA KEV catalog. Attackers must have local access but only low privilege; the weakness allows unauthorized access to critical data or complete compromise of all data accessible by the application, which could be used to exfiltrate or tamper with business information. The lack of a public exploit or KEV listing suggests exploitation is currently low but could rise if a public PoC is released.