A flaw in the Server Infrastructure component of Oracle Siebel CRM Deployment allows an attacker who already has logged on to the underlying infrastructure with high privileges to take full control of the Siebel CRM Deployment application. The vulnerability is easily exploitable and results in complete takeover of the deployment, compromising confidentiality, integrity, and availability. The weakness can be classified as improper access control and privilege escalation.

Oracle Corporation’s Siebel CRM Deployment product is affected. The vulnerability covers all supported versions from 17.0 through 26.9 of the deployment component.

The CVSS v3.1 base score is 6.7, reflecting a moderate severity but with local attack and high privileges required. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, which suggests it has not yet been widely exploited publicly. However, the local nature of the attack and the high privileged prerequisites mean that for systems where administrative access is granted, the risk is significant and the potential impact is full system compromise.