Oracle Siebel CRM CVE-2026-101446

Exploitation requires network access to the Siebel Cloud Manager component over HTTP and a low-privileged authenticated context (PR:L) - not a fully anonymous attacker, so a valid low-entitlement account or reachable authenticated interface is the gating prerequisite. No user interaction is required (UI:N) and attack complexity is low (AC:L), meaning once network and low-privilege access exist, exploitation against affected versions 17.0-26.9 is straightforward. The primary limiting factors are the need for some authenticated/low-privilege foothold and network reachability of the Cloud Manager HTTP interface; the scope change (S:C) implies the Cloud Manager's trust relationship to additional products is what enables impact beyond the vulnerable component.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-risk artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 9.9) describes network-reachable exploitation over HTTP with low attack complexity, requiring only low privileges and no user interaction, yielding full confidentiality/integrity/availability compromise and a scope change into additional products. Oracle itself characterizes it as 'easily exploitable' resulting in product takeover, which aligns with the AC:L/S:C metrics. However, key corroborating signals are absent: no EPSS score, KEV status, or POC indicator was provided in the input, so exploitation status is 'no public exploit identified at time of analysis' - the 9.9 reflects potential impact and ease, not observed in-the-wild activity. Note a tension worth flagging: the input Tags include 'Information Disclosure,' yet the description and vector indicate full takeover (C:H/I:H/A:H) well beyond mere disclosure - the tag understates the true impact. The scope-change (S:C) claim that attacks 'may significantly impact additional products' should be verified against the Oracle CPU advisory, as it materially raises blast radius.

A low-privileged user with a valid but minimally entitled account (or access to a tenant-adjacent HTTP endpoint) of Siebel Cloud Manager sends crafted HTTP requests to the affected Siebel CRM Cloud Applications component. Because attack complexity is low and no user interaction is needed, the attacker escalates to full takeover of the application and, per the scope change, pivots to impact additional connected products. No public exploit code was identified in the provided data at time of analysis.