This vulnerability in Oracle Siebel CRM Deployment's Server Infrastructure component allows an attacker with low privileges and logon access to the underlying infrastructure to compromise the deployment. The vulnerability affects versions from 17.0 up to and including 26.7. Successful exploitation can lead to complete takeover of the Siebel CRM Deployment, impacting confidentiality, integrity, and availability. The CVSS 3.1 vector indicates local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update advisory.

An attacker with low privileged access to the infrastructure hosting Siebel CRM Deployment can exploit this vulnerability to fully compromise the Siebel CRM Deployment. This results in complete loss of confidentiality, integrity, and availability of the affected system. The impact is rated high severity with a CVSS score of 7.8.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. Remaining on actively supported versions and timely application of Oracle patches is critical. Patch status is confirmed as available via the Oracle advisory at https://www.oracle.com/security-alerts/cspusep2026.html.