The vulnerability resides in the Server Infrastructure component of Oracle Siebel CRM Deployment. An attacker with low‑privileged access to the infrastructure can exploit the flaw to bypass intended controls and gain unauthorized access to all data that the deployment can read. The resulting impact is a loss of confidentiality; integrity and availability are not directly affected.

Oracle Siebel CRM Deployment versions 17.0 through 26.9. All installations of the Server Infrastructure component in that range are affected.

The CVSS base score of 5.5 indicates moderate risk. The EPSS score is < 1%, indicating a very low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. However, the attack requires local access to the infrastructure; once an attacker has a low‑privilege log‑on, the exploit is straightforward, so the likelihood of successful exploitation is high for an attacker who already has local access. The risk is primarily confidentiality loss.