This vulnerability in Oracle Siebel CRM Deployment (versions 17.0 to 26.6) enables an unauthenticated attacker who has physical network segment access to compromise the deployment. The attacker can gain unauthorized access to critical data and perform unauthorized creation, deletion, or modification of data. The CVSS vector indicates the attack requires adjacent network access (AV:A), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and impacts confidentiality and integrity at a high level (C:H/I:H) without affecting availability (A:N).

An attacker with physical access to the communication segment can fully compromise the Siebel CRM Deployment, resulting in unauthorized access and manipulation of critical data. This can lead to data breaches, data integrity loss, and potential operational disruption of the CRM system's data handling capabilities.

Oracle has released this vulnerability as part of its Critical Security Patch Update (CSPU) in August 2026. Customers are strongly advised to apply the relevant security patches promptly to affected versions (17.0 through 26.6). Staying on actively supported versions and timely patch application are critical to mitigating this vulnerability. No alternative mitigations or workarounds are indicated in the vendor advisory.