A local privilege escalation flaw in the Siebel CRM Deployment product permits a low‑privileged user who can log on to the infrastructure to create, delete or modify critical data. The vulnerability provides unauthorized access to all data accessible by the deployment, leading to significant confidentiality and integrity breaches while availability is not directly affected.

Oracle Siebel CRM Deployment versions 17.0 through 26.9 are affected.

The flaw carries a CVSS 3.1 score of 7.1, indicating high severity for confidentiality and integrity. Because the attack vector is local with low privilege, the exploit requires user presence or interaction on the affected infrastructure; however the exploitability appears high due to the described easy exploitation. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, so current exploitation likelihood is unknown but cannot be ruled out.