The vulnerability resides in the Server Infrastructure component of Oracle Siebel CRM Deployment and permits a low‑privilege attacker who can log on to the infrastructure to compromise the deployment. Successful exploitation enables the attacker to create, delete, or modify critical data or gain full access to all data accessible through the deployment, thereby affecting both confidentiality and integrity. The vulnerability does not create a denial‑of‑service condition.

Oracle Siebel CRM Deployment, specifically versions 17.0 through 26.9, of the Server Infrastructure component.

The CVSS rating of 6.3 indicates moderate severity with significant confidentiality and integrity impacts. Although EPSS data is not available, the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploitation at this time. The attack vector is inferred to be local, requiring the attacker to have an existing logon to the infrastructure where Siebel CRM Deployment runs. The lack of a required user interface interaction and the need for low privilege emphasize that the flaw represents an access‑control weakness that can be abused by users with limited permissions.