An issue in the Siebel CRM Deployment Server Infrastructure component allows an attacker who has already logged on with high privileges on the executing infrastructure to gain unauthorized control of the deployment. The flaw can lead to a partial denial of service, disrupting the availability of the Siebel CRM Service.

Oracle Siebel CRM Deployment versions from 17.0 through 26.9 are affected. This includes all builds referencing the Server Infrastructure component. Users running any of those versions should verify the exact build and consider remediation steps.

With a CVSS 3.1 base score of 2.3, this vulnerability presents a low severity risk, impacting only availability. The attack vector is local with attacker privilege level High, and it requires that the attacker already have a logon to the infrastructure hosting the deployment. The EPSS score is < 1% and it is not listed in CISA KEV. Because the flaw stems from improper access control allowing local privileged use to cause a DoS, the likelihood of exploitation depends on the presence of high‑privileged accounts within the environment.