The vulnerability resides in the Server Infrastructure component of Oracle Siebel CRM Deployment. It allows an attacker who already has low‑level privileges and can communicate with the SQL interface over the network to compromise the deployment. Successful exploitation can lead to full compromise, granting the attacker control over the system and exposing its data. The impact includes confidentiality, integrity and availability loss, as reflected in the CVSS 3.1 score of 8.8 with a vector indicating network‑based, low complexity, low privilege, no user interaction, and unchanged scope.

Oracle Corporation’s Siebel CRM Deployment is affected. The vulnerable product versions span from 17.0 up to 26.7, inclusive. Systems running any of these releases should be verified for patch status.

The vulnerability scores 8.8 on CVSS, marking it as high severity. The EPSS score is below 1 %, indicating a low probability of widespread exploitation, but the risk remains because the flaw is easily exploitable for victims with network access. It is not listed in CISA’s KEV catalog. The attack vector is inferred to be a network‑based SQL interaction that does not require user interaction, relying on low privilege exploitation.