Oracle Siebel CRM Deployment contains a vulnerability that permits a local user with limited privileges to gain unauthorized access to sensitive data. The flaw allows the attacker to read all data accessible through the deployment, jeopardizing confidentiality. The vulnerability is easy to exploit once an attacker has logged onto the infrastructure where Siebel CRM Deployment runs.

Oracle Siebel CRM Deployment versions 17.0 through 26.9 are affected.

The CVSS 3.1 base score of 5.5 indicates moderate severity, driven solely by confidentiality impact. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. Attackers must have local logon access, which confines exploitation to users already present on the infrastructure but still enables them to compromise the deployment and access all data it manages.