This vulnerability affects Oracle Siebel CRM Deployment versions 17.0 through 26.7. It permits a low privileged attacker who has physical access to the communication segment attached to the hardware running the deployment to compromise the system. Exploitation can result in unauthorized access to critical or all accessible data within the Siebel CRM Deployment and cause denial of service through hangs or repeated crashes. The CVSS 3.1 vector indicates attack complexity is low, privileges required are low, no user interaction is needed, and the impact is high on confidentiality and availability but no integrity impact. Oracle has included this fix in their September 2026 Critical Security Patch Update, which contains numerous patches across multiple products.

The vulnerability allows unauthorized access to sensitive data within the Siebel CRM Deployment and can cause denial of service by hanging or crashing the system repeatedly. This compromises confidentiality and availability of the affected deployment. The attack requires physical access to the communication segment attached to the hardware, which limits remote exploitation but still poses a significant risk in environments where such access is possible.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. The vendor advisory emphasizes remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.