This vulnerability in Oracle Siebel CRM Deployment's Database Upgrade component allows an attacker with low privileges and logon access to the infrastructure to fully compromise the Siebel CRM Deployment. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates that the attack requires local access with low complexity and privileges but results in high impact on confidentiality, integrity, and availability. Affected versions explicitly include 17.0 and extend through 26.5. Oracle's June 2026 Critical Security Patch Update addresses this and numerous other vulnerabilities, recommending customers apply patches without delay. The advisory does not specify a separate patch for this vulnerability but emphasizes the importance of applying the CSPU. No public exploits are currently known.

Successful exploitation allows a low privileged attacker with logon access to the infrastructure hosting Siebel CRM Deployment to take over the deployment. This results in full compromise affecting confidentiality, integrity, and availability of the system. The CVSS score of 7.8 reflects a high-severity impact.

Oracle has included this vulnerability in its June 2026 Critical Security Patch Update. Customers are strongly advised to apply this update promptly to remediate the vulnerability. Until patches are applied, risk may be reduced by limiting logon access to the infrastructure and removing unnecessary privileges from users. Oracle does not provide a separate patch or workaround specific to this vulnerability beyond the CSPU. Patch status is not explicitly confirmed beyond the advisory; customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest remediation guidance.