This vulnerability in Oracle Siebel CRM Deployment's Server Infrastructure component affects versions 17.0 through 26.7. It enables a low privileged attacker who has logon access to the underlying infrastructure to compromise the Siebel CRM Deployment. Exploitation requires user interaction from a third party. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) reflects that the attack is local with low complexity, requires low privileges, and user interaction, and results in high impact on confidentiality, integrity, and availability. Oracle has published this vulnerability as part of their September 2026 Critical Security Patch Update, which includes a large number of security patches across multiple products.

Successful exploitation can result in complete takeover of the Siebel CRM Deployment, impacting confidentiality, integrity, and availability of the system. The attack requires local access with low privileges and user interaction, which limits remote exploitation but still poses a significant risk within environments where attackers have some access. There are no known exploits in the wild at this time.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed as available via the Oracle advisory. No alternative mitigations or workarounds are specified.