Vulnerability resides in the Configuration Tools component of Oracle Siebel CRM Development. The flaw permits a high‑privileged attacker who can log on locally to the host running the application to compromise the Siebel CRM Development process. Successful exploitation leads to unauthorized creation, deletion or modification of critical data and could grant full read access to all data available to the application.

Affected vendors and versions are Oracle Corporation's Siebel CRM Development, specifically all releases from 17.0 through 26.9, which contain the vulnerable Configuration Tools module. These versions are commonly deployed in enterprise environments for customer relationship management development and testing.

The CVSS v3.1 base score of 6.0 indicates moderate severity with high confidentiality and integrity impact. Attackers must have local high‑privilege access (AV:L, AC:L, PR:H, UI:N) to exploit the flaw. The EPSS score of < 1% suggests a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the local privilege requirement means the risk is significant for systems with untrusted users or insecure local accounts, and it can be mitigated by patching or restricting privileged access.