This vulnerability in Oracle Siebel CRM Deployment (component: Installation) affects supported versions 17.0 through 26.6. It is easily exploitable by an attacker with low privileges who has logon access to the infrastructure where Siebel CRM Deployment runs. Successful exploitation can lead to full compromise and takeover of the Siebel CRM Deployment environment. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

An attacker with low privileges and logon access to the infrastructure can exploit this vulnerability to fully compromise the Siebel CRM Deployment, resulting in complete takeover. This includes high impact on confidentiality, integrity, and availability of the affected system.

Oracle has released this vulnerability as part of their August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant security patches promptly to affected versions of Siebel CRM Deployment. Staying on actively supported versions and applying Oracle patches without delay is recommended. Patch availability details should be confirmed via the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. No alternative mitigations or temporary fixes are indicated.