The vulnerability resides in the Database Upgrade component of Oracle Siebel CRM Deployment and allows an attacker who has only low‑privileged local access to the hosting infrastructure to compromise the application. The flaw appears to involve improper privilege handling, as suggested by the CVSS vector AV:L/PR:L and the impact escalation to full control of the deployment, resulting in loss of confidentiality, integrity, and availability. The description explicitly states that successful exploitation can lead to takeover of Siebel CRM Deployment.

Oracle Siebel CRM Deployment versions 17.0 through 26.5 are affected. All builds of this product that fall under the Oracle Siebel CRM umbrella are vulnerable, as outlined in the vendor’s security advisory.

The CVSS score of 7.8 denotes a high‑severity flaw, yet the EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. It is a local attack, requiring the adversary to log on to the infrastructure where Siebel CRM Deployment runs before attempting to manipulate the upgrade component. No additional user interaction is required once local access is established.