EUVD-2026-105871
GHSA-j2cm-rqr8-j9j6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged logon to Siebel host
-
ExploitInteract with Integration Scripting component
-
ExecutionWin high-complexity exploitation conditions
-
ImpactRead, modify, or delete critical Siebel data
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires an attacker to already possess a low-privileged account with logon access to the infrastructure where Siebel CRM Development executes (AV:L, PR:L), and to interact with the Integration - Scripting component. Oracle explicitly labels it 'difficult to exploit' (AC:H), indicating specific timing, configuration, or environmental preconditions must be met rather than a single deterministic action. Limiting factors that reduce real-world risk: no remote network exploitation is possible, valid authenticated access is mandatory, and no availability impact occurs (A:N). Affected deployments are Siebel CRM Development versions 17.0 through 26.9; environments on patched October 2026 CPU levels are not affected. |
| Impact | This is a moderate-severity, low-urgency issue rather than a top priority. The Oracle-assigned CVSS 3.1 score is 6.3 with vector AV:L/AC:H/PR:L/UI:N/S:U - meaning exploitation requires local/logon access to the infrastructure running Siebel CRM Development, is high-complexity, and needs an already-authenticated low-privileged account. High confidentiality and integrity impact (C:H/I:H) is offset by the restrictive access conditions (AV:L + AC:H + PR:L), which substantially lowers real-world exploitability. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active or probable exploitation - no public exploit identified at time of analysis. No conflicting severity signals are present, but note a tagging inconsistency: the input carries an 'Authentication Bypass' tag, which contradicts the CVSS vector (PR:L requires valid privileges) and the description (attacker must already have logon) - this is not an authentication bypass and the tag appears mislabeled. CWE is listed as N/A, so the precise weakness class is unconfirmed. |
| Exploit ScenarioDerived | A low-privileged user who already has a valid logon to the host where Siebel CRM Development runs abuses the Integration/Scripting component to read, modify, or delete critical application data beyond their authorization. Because the attack vector is local and complexity is high (AV:L/AC:H), the attacker must win specific timing or environmental conditions, not just send a single request. No public exploit code is known at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
A low-privileged attacker who already holds logon access to the host running Siebel CRM Development 17.0 through 26.9 can abuse the Integration - Scripting component to read and modify critical data within the application. Oracle rates this 6.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) and explicitly labels it difficult to exploit, since high attack complexity means specific timing, configuration, or environmental preconditions must align; there is no availability impact and no remote network path. No public exploit code has been identified at time of analysis and there is no KEV entry, so this is a moderate-severity, low-urgency item for patch-cycle handling rather than emergency response; remediation is delivered through Oracle's October 2026 Critical Patch Update.
RemediationAI
Apply Oracle's October 2026 Critical Patch Update for Siebel CRM, following the affected-version matrix in https://www.oracle.com/security-alerts/cpuoct2026.html to confirm the exact patched release level for 17.0 through 26.9; environments brought to that CPU level are not affected. Where patching must be staged, reduce exposure by restricting interactive logon to Siebel CRM Development hosts and the Integration - Scripting component to the smallest set of administrators and integration accounts that genuinely require it, accepting that this may disrupt legitimate script development and integration jobs. Enforce least privilege so that scripting and integration users cannot reach production data domains they do not own, and audit or version-control script and integration-service changes so tampering is detectable - noting that such monitoring is detective rather than preventive and adds operational overhead. Since exploitation requires existing local logon access with high attack complexity and no public exploit code exists, these compensating controls are reasonable interim measures while the CPU is scheduled; there is no need for emergency out-of-band action.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw sits in the Integration - Scripting component of Oracle Siebel CRM Development, the layer where Siebel integration services and server-side scripts (eScript/business service logic) are authored and executed to move and transform CRM data between Siebel and external systems. Because scripts in this component run with application-level trust, a user who can reach the scripting surface with only low privileges may be able to influence logic that operates on records beyond their intended authorization scope, yielding unauthorized creation, deletion, and modification of data plus disclosure of data the account should not reach. No CWE identifier was supplied by the source, but the assessed impact pattern (high confidentiality and high integrity with no availability effect, single-scope) corresponds to an authorization/access-control weakness rather than memory corruption or injection of executable code; the accompanying 'Authentication Bypass' tag aligns with a low-privileged principal obtaining capabilities normally reserved for higher-privileged roles. The vector's AV:L and PR:L components describe the real constraint: the attacker must already be operating on the infrastructure hosting Siebel CRM Development with a valid low-privileged logon, and AC:H reflects that exploitation depends on non-default configuration or precise timing rather than a single deterministic request. UI:N means no victim interaction is required, and S:U confirms the compromise stays within the Siebel application boundary.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Requires authenticated local logon so AV:L and PR:L; vendor marks it difficult to exploit so AC:H; high data read/modify impact gives C:H/I:H with no availability effect (A:N).
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Integration - Scripting). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Development executes to compromise Siebel CRM Development. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM Development accessible data as well as unauthorized access to critical data or complete access to all Siebel CRM Development accessible data. CVSS 3.1 Base Score 6.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB