Oracle Siebel CRM CVE-2026-101459

Requires a valid low-privileged Siebel CRM account (CVSS PR:L) and network HTTP reachability to the Server Infrastructure component of Siebel CRM Deployment versions 17.0 through 26.9; no user interaction is needed (UI:N) and attack complexity is low (AC:L). The primary limiting factor is that the attacker must first authenticate - this is NOT unauthenticated access despite the 'Authentication Bypass' tag - so exposure is constrained to environments where attackers can obtain or already hold a low-privilege CRM credential and reach the server over HTTP. No special non-default feature or configuration is named in the description.

This is a genuine priority-worthy flaw, though not a drop-everything emergency on exploitation signals alone. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) describes network-reachable, low-complexity exploitation over HTTP that requires only a low-privileged account and no user interaction, yielding high confidentiality and integrity impact plus partial availability loss - a strong combination that elevates the 8.3 base score legitimately. However, several exploitation signals are MISSING from the input: there is no EPSS probability, no CISA KEV listing, and no POC indicator, so real-world exploitation likelihood cannot be quantified and should be treated as 'no public exploit identified at time of analysis.' There is also a signal conflict to verify: the input Tags include 'Authentication Bypass,' but both the description ('low privileged attacker') and the CVSS vector (PR:L) indicate authentication IS required - these are contradictory, so the authentication-bypass characterization should be confirmed with Oracle before acting on it. Net: prioritize based on the broad data impact and low attack complexity against an internet/network-reachable enterprise CRM, while recognizing that no active-exploitation or POC evidence is present in the provided data.

An attacker who holds any low-privileged Siebel CRM account (or obtains one via phishing/credential reuse) reaches the Server Infrastructure component over HTTP and sends crafted requests that abuse the flaw to read and modify data across the Siebel CRM Deployment. Because attack complexity is low and no user interaction is needed, a single authenticated session can escalate to broad read/write access and partial service disruption. No public exploit code is identified in the provided data.