This vulnerability in the Oracle Siebel CRM Deployment product’s Server Infrastructure component enables a high‑privileged attacker who already has logon access to the underlying infrastructure to compromise the Siebel CRM Deployment service. Successful exploitation can lead to full takeover of the deployment, providing the attacker with total control over the application and the data it handles. The flaw results in confidentiality, integrity, and availability impacts as described by the CVSS vector.

Affected vendors and products include Oracle Corporation’s Siebel CRM Deployment. The vulnerability applies to supported versions 17.0 through 26.9, as identified by the vendor’s advisory. Systems running any of these versions on infrastructure where users can log on with privileged access are at risk.

The CVSS v3.1 base score is 6.7, indicating a medium‑to‑high severity when the attacker can access the host locally. The vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) shows the need for local privileges but does not require network access, making the risk high in environments where users have administrative or equivalent rights on the server. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog, though it remains a significant threat due to its potential to grant full control over the application.