A flaw in the Server Infrastructure component of Oracle Siebel CRM Deployment permits a low‑privileged attacker who can log onto the same environment to read confidential data or, if they gain sufficient authority, to obtain all data that the deployment can access. The weakness is caused by improper access control (CWE‑269), which allows data exposure without affecting integrity or availability.

Oracle Corporation’s Siebel CRM Deployment product, versions 17.0 through 26.9, is vulnerable. No other versions were listed in the advisory, so the impact is confined to those releases.

The CVSS 3.1 score of 5.5 indicates moderate severity, while the EPSS score of less than 1% implies a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated to the infrastructure hosting the application; thus the attack surface is limited to users who can log onto that environment. Nevertheless, the potential for unauthorized data access warrants early attention as an update becomes available.