Oracle Siebel CRM CVE-2026-47011

Exploitation requires: (1) The attacker must hold a valid low-privilege account with authenticated access to the Siebel CRM Deployment instance over HTTP - this is not an unauthenticated attack; (2) The Siebel Application Interface component must be network-accessible to the attacker; (3) The attack is difficult to execute due to high complexity (AC:H), implying specific preconditions such as precise request timing, session state alignment, or environmental conditions that are not guaranteed; (4) A human victim other than the attacker must perform some interaction with the system during or to enable the attack - the exact interaction is unspecified in available data but is a hard requirement per CVSS UI:R. Limiting factors: The combination of AC:H, PR:L, and UI:R substantially narrows the realistic attacker population to motivated insiders or sophisticated external actors with existing foothold credentials; opportunistic or automated exploitation is implausible under these constraints.

The aggregate risk signal for this vulnerability is low. The CVSS 3.1 base score of 2.6 is corroborated by four compounding constraints: high attack complexity (AC:H), a low-privilege prerequisite (PR:L), mandatory victim interaction (UI:R), and a limited confidentiality-only impact on a data subset (C:L). No EPSS probability was provided in the source data - that gap should be resolved by checking current NVD or FIRST EPSS feeds before making prioritization decisions. The vulnerability is not listed in the CISA KEV catalog, and no POC exploit code has been identified. The 'Authentication Bypass' tag is somewhat at odds with the PR:L vector, which requires the attacker already possess a valid low-privilege account; this suggests the bypass is intra-application (authorization boundary), not a full unauthenticated bypass - teams should not conflate the tag with a zero-auth condition. Real-world priority is low: the combination of AC:H and UI:R makes reliable exploitation operationally difficult, and the impact ceiling is a partial data read with no integrity or availability consequence.

An attacker with a valid low-privilege Siebel CRM account sends a specially crafted HTTP request to the Application Interface that triggers a high-complexity authorization bypass, requiring a separate authenticated user (victim) to concurrently interact with the system to complete the attack. If successful, the attacker gains read access to a subset of CRM data outside their authorized scope - such as records belonging to other users or restricted business objects. No public exploit code exists at time of analysis, and the AC:H and UI:R constraints make reliable, repeatable exploitation difficult without prior knowledge of the target environment.