A vulnerability exists in the Siebel CRM Deployment product of Oracle Siebel CRM, specifically in the Server Infrastructure component. This vulnerability affects supported versions from 17.0 through 26.7. It allows a low privileged attacker with network access via HTTP to compromise the deployment, potentially leading to unauthorized access to critical data and partial denial of service. The vulnerability has a CVSS 3.1 base score of 7.1, indicating high severity with confidentiality and availability impacts. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which provides targeted security fixes for affected products.