This vulnerability in Oracle Siebel CRM Deployment's Server Infrastructure component affects versions 17.0 through 26.7. It is easily exploitable by an attacker with low privileges who has logon access to the infrastructure where the deployment runs. Exploitation can result in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by the Siebel CRM Deployment. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects a local attack vector with low attack complexity, requiring low privileges and no user interaction, impacting confidentiality and integrity at a high level but not availability. Oracle has included this vulnerability in their September 2026 Critical Security Patch Update, which provides targeted security fixes across multiple products including Siebel Applications. The advisory strongly recommends applying patches promptly to mitigate exploitation risks.

An attacker with low privileges and logon access to the infrastructure can exploit this vulnerability to gain unauthorized creation, deletion, or modification rights over critical data or gain complete access to all data accessible by Siebel CRM Deployment. This compromises confidentiality and integrity of sensitive data managed by the affected Siebel CRM Deployment versions. There is no reported impact on availability. No known exploits in the wild have been reported as of the advisory date.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches without delay to remediate the vulnerability. Staying on actively supported versions and promptly applying Oracle's security patches is the recommended mitigation. Patch availability and installation instructions are provided in the Oracle advisory at https://www.oracle.com/security-alerts/cspusep2026.html. No alternative mitigations or workarounds are specified.