Oracle Siebel CRM CVE-2026-62585

Exploitation requires network HTTP reachability to the Siebel CRM Administration application's Data Archival component on an affected version (25.12 through 26.6); per the CVSS vector AV:N/AC:L/PR:N/UI:N there are no authentication, privilege, or user-interaction prerequisites, so any actor able to route an HTTP request to the admin interface can attempt it against default configurations. The primary limiting factor is exposure: organizations that keep the Siebel Administration interface on an internal/management network rather than internet-facing substantially reduce the attack surface, and only the specific affected version band 25.12-26.6 is in scope.

All available severity signals point to high real-world risk: the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (base 9.8), meaning remote, low-complexity, unauthenticated, no-user-interaction exploitation with total impact to the affected component. Countervailing signals moderate the urgency: there is no EPSS score provided, no CISA KEV listing (not confirmed actively exploited), and no public proof-of-concept identified at time of analysis, so exploitation is currently theoretical rather than observed. No SSVC decision data was supplied. The net assessment is a genuine priority - the exploitability profile is worst-case and Siebel Administration is a sensitive target - but it is a patch-urgently rather than emergency-because-exploited situation given the absence of KEV and POC evidence. The Oracle tag 'Information Disclosure' is narrower than the 'takeover'/C:H:I:H:A:H described, a minor conflict that suggests the tag is incomplete; rely on the CVSS impact metrics.

An attacker who can reach the Siebel CRM Administration web interface over HTTP sends a crafted request to the Data Archival component and, without any credentials or user interaction, gains full administrative control of the module - enabling data theft, tampering with archived CRM records, or service disruption. Because complexity is low and no authentication is required, exploitation could be scripted and repeatable once the vulnerability details are reverse-engineered from the patch, though no public exploit code has been identified at time of analysis.