Siebel CRM Deployment CVE-2026-101458

Exploitation requires network HTTP reachability to a running Siebel CRM Deployment instance exposing the Server Infrastructure component, across supported versions 17.0 through 26.9. Per the CVSS vector no authentication (PR:N), no user interaction (UI:N), and only low attack complexity (AC:L) are needed, so default-reachable deployments are exploitable without preconditions once the endpoint is accessible. The primary limiting factor is network exposure: deployments where the Siebel HTTP interface is restricted to internal/segmented networks or placed behind authenticating reverse proxies/WAFs materially reduce reachability. Impact is bounded to high confidentiality loss plus limited integrity writes (I:L) with no availability impact (A:N).

This is a genuinely high-priority issue by its intrinsic metrics: the Oracle-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw requiring no user interaction, scoring 8.2 with high confidentiality and low integrity impact (no availability impact). The PR:N value means exploitation requires no credentials, which is consistent with the 'Authentication Bypass' tag and amplifies real-world exposure for any internet- or intranet-facing Siebel deployment. However, key exploitation-likelihood signals are MISSING, not merely low: no EPSS score, no CISA KEV listing, and no POC/exploit-code reference are present in the input, so there is currently no public evidence of exploitation or weaponization. There is also no SSVC decision data provided. The net picture is a high intrinsic severity that cannot yet be corroborated by any exploitation-activity signal - treat it as a priority-patch candidate on severity and exposure grounds (part of the Oracle October 2026 Critical Patch Update), while recognizing that likelihood-of-exploitation telemetry is absent rather than confirmed low.

A remote attacker with HTTP access to an exposed Siebel CRM Deployment 'Server Infrastructure' endpoint sends a crafted unauthenticated request to the service, bypassing authentication to read critical Siebel data and perform limited unauthorized writes (insert/update/delete on some data). Because AC:L and PR:N/UI:N apply, no credentials, user interaction, or special timing are needed. No public exploit code is identified at time of analysis, so this remains a theoretical-but-low-barrier scenario rather than a demonstrated one.