The vulnerability is located in the Server Infrastructure component of Oracle Siebel CRM Deployment. All supported versions from 17.0 through 26.9 are affected. A user with high‑privilege access to the infrastructure where the deployment runs can exploit the flaw to create, delete, or modify data and gain full access to the application’s data. This results in confidentiality and integrity compromises of critical data, while availability is not directly impacted.

The affected product is Oracle Siebel CRM Deployment, specifically the Server Infrastructure component. Versions ranging from 17.0 to 26.9 are vulnerable. Any environment that runs one of these versions and allows a high‑privileged account to log on to the underlying infrastructure is susceptible to exploitation.

The CVSS 3.1 base score of 6.0 indicates a medium severity vulnerability. The attack vector is local, requiring high privileges and no user interaction. Because the attacker must already have a foothold on the infrastructure, the exploitation likelihood is low, as reflected by an EPSS score of less than 1%. The vulnerability is not listed in CISA KEV. Nonetheless, the potential for significant data loss or alteration warrants immediate attention where the affected versions are in use.