EUVD-2026-105923
GHSA-pghr-pwfh-mj4p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Siebel EAI HTTP endpoint
-
DeliverySend crafted malformed request
-
ExploitTrigger unhandled condition in EAI component
-
ExecutionIntegration service hangs or crashes
-
ImpactComplete denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Siebel CRM Integration EAI (Enterprise Application Integration) HTTP interface; per the vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special non-default configuration are stated as prerequisites, and all supported versions 17.0 through 26.9 are affected. The principal limiting factor is exposure of the EAI endpoint: Siebel integration interfaces are frequently segmented behind internal networks, reverse proxies, or VPNs rather than published to the internet, so realistic risk hinges on whether the EAI HTTP listener is reachable by the attacker. Impact is limited to denial of service of the integration component only - no data exposure or modification - and does not propagate beyond the affected service (S:U). |
| Impact | This is a genuine but bounded availability risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a trivially reachable flaw - network-accessible over HTTP, low attack complexity, no privileges, no user interaction - meaning any remote unauthenticated party who can reach the Siebel EAI endpoint can trigger it. However, impact is confined to availability (C:N/I:N/A:H): the result is a hang or repeatable crash (complete DoS) of Siebel CRM Integration, with no confidentiality or integrity loss and no scope change (S:U). No EPSS score was supplied, so real-world exploitation probability cannot be quantified from the input. The CVE is NOT in CISA KEV and NO public exploit code is referenced, so there is no public exploit identified at time of analysis. SSVC inputs (exploitation status, automatability, technical impact) were not provided and cannot be assessed. Net: easy to exploit and reachable, but the 7.5 score is driven entirely by availability - treat as a meaningful patching priority for exposed Siebel integration tiers, but it is a service-disruption issue, not a data-breach or RCE issue, so it ranks below any confidentiality/integrity-impacting flaw of equal score. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker who can reach the Siebel EAI HTTP interface sends a crafted request that the integration component cannot process cleanly, causing it to hang or crash and denying service to all users of Siebel CRM Integration. No exploit code is publicly referenced, but the AV:N/AC:L/PR:N/UI:N profile means the condition is easy to trigger once the endpoint is reachable. Repeating the request produces a reliably reproducible complete denial of service. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Unauthenticated remote attackers who can reach the Siebel CRM Integration EAI HTTP interface can cause a hang or repeatedly crash the integration component, producing a complete denial of service against that service. All supported versions from 17.0 through 26.9 are affected, and the CVSS 3.1 score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), with impact limited to availability and no confidentiality or integrity effect. No public exploit code or confirmed active exploitation was identified at time of analysis, so realistic risk depends primarily on whether the EAI endpoint is exposed beyond trusted internal networks.
RemediationAI
Apply the Oracle Critical Patch Update for October 2026, which is the vendor advisory addressing this issue; the provided data does not specify an exact patched build beyond the supported 17.0-26.9 range, so confirm the appropriate Siebel CRM patch level with Oracle support before deployment (https://www.oracle.com/security-alerts/cpuoct2026.html). Until patching is complete, reduce exposure of the EAI HTTP listener by restricting it to trusted networks, placing it behind a reverse proxy or VPN, and blocking direct internet access; the trade-off is that legitimate external integration partners must be routed through the approved access path. Add rate limiting or connection throttling at the perimeter for the EAI endpoint to make repeated crash attempts harder to sustain, accepting possible latency or throughput limits for legitimate integration traffic. Monitor EAI service availability and restart patterns so that repeated hangs or crashes are detected quickly, and validate that the EAI component is not unnecessarily exposed on internet-facing interfaces.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is in Oracle Siebel CRM's Enterprise Application Integration (EAI) component, which exposes HTTP-based integration endpoints used to exchange data with external systems. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H indicates a remotely reachable, low-complexity attack that requires no authentication and no user interaction, and that remains contained within the affected service (S:U). No CWE was provided, so the precise implementation root cause is not disclosed; the observable effect is resource exhaustion or a fault condition that hangs or repeatedly crashes the EAI service rather than enabling code execution, data access, or modification. Because Siebel integration listeners are often segmented behind reverse proxies, VPNs, or internal network boundaries, exposure of the EAI HTTP interface is the principal determinant of practical exploitability.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated HTTP trigger gives AV:N/AC:L/PR:N/UI:N; impact is a complete DoS only, so C:N/I:N/A:H with unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel CRM Integration. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Executive ViewAI
Oracle Siebel CRM's Integration EAI HTTP interface is exposed to an unauthenticated remote denial-of-service condition affecting every supported release from 17.0 through 26.9, allowing an attacker who can reach the endpoint to hang or repeatedly crash the integration service and disrupt dependent business workflows. Because impact is confined to availability, the exposure is primarily a operational continuity and revenue-risk issue for organizations running externally reachable or broadly segmented EAI endpoints, rather than a data confidentiality or integrity concern. Leadership should care because customer-facing order, service, and partner integration flows can be halted for extended periods with no vendor patch currently available.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict EAI HTTP interface reachability to allowlisted internal networks, front the endpoint with a reverse proxy or WAF enforcing rate and connection limits, segment the integration component from other Siebel tiers, enable monitoring and automatic restart alerting on the integration service, and maintain tested failover procedures for dependent business processes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB