This vulnerability in Oracle Siebel CRM Integration's Event Publish and Subscribe component allows an attacker with physical access and high privileges to gain unauthorized read access to a subset of accessible data. The vulnerability affects version 17.0 and has a CVSS 3.1 score of 1.9 with vector AV:P/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N, indicating it is difficult to exploit and impacts confidentiality only. The scope of impact may extend beyond Siebel CRM Integration to other products. Oracle's July 2026 Critical Patch Update advisory lists this vulnerability but does not explicitly confirm the availability of a patch or remediation level for it.

Successful exploitation can result in unauthorized read access to some data within Siebel CRM Integration. The vulnerability requires physical access, high attack complexity, and high privileges, limiting the likelihood of exploitation. There is no impact on data integrity or availability. The vulnerability's scope change means other products may also be impacted indirectly.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly when available and remaining on actively supported versions. Given the requirement for physical access and high privileges, limiting physical access and enforcing strict privilege controls can reduce risk until a patch is confirmed.