The vulnerability resides in the eDetailing component of Oracle Siebel CRM’s Life Sciences module. An attacker with low privileged network access can inject arbitrary SQL statements, allowing the attacker to alter, delete, or exfiltrate data and ultimately take full control of the application. Successful exploitation results in complete compromise of confidentiality, integrity and availability of the Siebel Apps – Life Sciences system.

Oracle Corporation’s Siebel Apps – Life Sciences, versions 17.0 through 26.9, are affected. Any deployment of these releases that has not applied the vendor’s update is susceptible.

The CVSS Base Score of 8.8 indicates high severity, affecting confidentiality, integrity and availability. The EPSS score of < 1% indicates a very low probability of exploitation in the wild at present, and the vulnerability is not included in CISA’s KEV catalog. The description indicates that an attacker only needs low privilege network access and the ability to inject SQL to compromise the application.