The vulnerability in Oracle Siebel CRM Deployment (component: Server Infrastructure) affects supported versions 17.0 to 26.7. It is exploitable by a low privileged attacker who has access to the physical communication segment attached to the hardware where the product runs. Successful exploitation can lead to unauthorized access to critical data or a denial of service condition causing the application to hang or crash repeatedly. The CVSS 3.1 vector is AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H, reflecting network attack complexity, low privileges required, no user interaction, and high confidentiality and availability impacts.

Exploitation can result in unauthorized access to critical data within Siebel CRM Deployment or cause a complete denial of service by crashing the application. This compromises confidentiality and availability of the affected system. There is no indication of integrity impact. The vulnerability requires attacker access to the physical communication segment, limiting remote exploitation scenarios.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to remediate this issue. No vendor advisory states that no action is required or that the issue is already mitigated without patching. Patch status is confirmed as official-fix via Oracle's advisory. Users should remain on actively supported versions and apply the security patches without delay.