The vulnerability in Oracle Siebel CRM Deployment allows an attacker who already has high privileged access to the same infrastructure to modify, read, or delete data that should be protected. Successful exploitation also enables a partial denial of service on the component. The CVSS 3.1 score of 3.9 reflects low but non‑negligible impacts on confidentiality (C:L), integrity (I:L), and availability (A:L).

Oracle Siebel CRM Deployment versions from 17.0 through 26.9 are affected. Users running any of those releases are potentially exposed to unauthorized data modification, read, and a partial denial of service when they are logged into the infrastructure where the product is deployed.

The attack vector is local, requiring an attacker to have high‑privileged login on the infrastructure hosting Siebel CRM Deployment. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the overall risk is moderate. The CVSS score indicates limited impact beyond privileged accounts, but any compromise of such accounts could lead to confidentiality, integrity, and availability disruptions for the affected data set.