Siebel CRM Deployment CVE-2026-101461

Exploitation requires a network-reachable Siebel CRM Deployment instance (Server Infrastructure component) on an affected version in the range 17.0 through 26.9, accessible over HTTP. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special non-default configuration are stated as prerequisites - this behaves as remote unauthenticated exploitation against reachable Siebel CRM Deployment servers. The principal limiting factors are network exposure (deployments restricted to internal networks or behind VPN/WAF are far less exposed than internet-facing ones) and version (installations already patched via Oracle CPU October 2026, or outside 17.0-26.9, are not affected). Impact is confined to confidentiality (C:H, I:N, A:N), so the flaw enables data disclosure but not data tampering or service disruption on its own.

This is a genuine prioritization concern driven primarily by its exposure profile rather than by observed exploitation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U) describes a network-reachable, low-complexity flaw requiring no authentication and no user interaction - the easiest class of vulnerability to attack - and Oracle's own description reinforces 'easily exploitable' by an unauthenticated attacker over HTTP. The 7.5 base score is bounded by the impact profile being confidentiality-only (C:H/I:N/A:N): an attacker can read critical or all Siebel CRM Deployment-accessible data but cannot, through this flaw alone, modify data or disrupt availability. Critically, several escalation signals are ABSENT from the input: no EPSS score is provided, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced, so there is no evidence of active or at-scale exploitation at this time. The conflict to note explicitly: the 'Authentication Bypass' tag implies a stronger access-control defeat than the description supports - the description only states the attack is unauthenticated (consistent with PR:N), not that it bypasses an authentication control; treat the tag as unverified. Net: a high-severity, pre-authentication information-disclosure bug in internet-facing Siebel deployments warrants prompt patching, but current data does not indicate widespread active exploitation.

An attacker locates an internet-facing Siebel CRM Deployment endpoint and sends crafted HTTP requests to the Server Infrastructure component without any credentials or user interaction. Because the flaw is unauthenticated and low-complexity, the attacker retrieves confidential CRM data - potentially all data accessible to the deployment - in a single-stage request. No public exploit code is referenced at the time of analysis, so exploitation would require independent research or reverse-engineering of the Oracle fix.