Oracle Siebel CRM CVE-2026-62592

The required condition is network reachability of the Siebel CRM Integration Open Integration HTTP interface from the attacker's position - per CVSS AV:N/AC:L/PR:N/UI:N, no authentication, no user interaction, and no special client-side conditions are needed against affected 25.12-26.6 deployments. The primary limiting factor is exposure: exploitation depends on the attacker being able to reach the integration HTTP endpoint, so deployments where that listener is confined to an internal or partner-only network segment are substantially harder to attack than internet-exposed ones. Version is also a hard limiter - only Siebel CRM Integration 25.12 through 26.6 are stated as affected.

The signals available point to a genuine high priority rather than an inflated score: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H reflects unauthenticated, low-complexity, remotely reachable full compromise, which is the profile attackers weaponize quickly once details or an exploit surface. That said, several corroborating signals are absent - there is no EPSS score, no KEV listing, and no public proof-of-concept in the provided data - so current real-world exploitation cannot be asserted, and the 'Information Disclosure' tag understates the vendor-scored full-takeover impact and should not be relied upon. Because Siebel is an internet-or-partner-facing integration tier in many enterprises, even a mid-sized municipal IT team in ustka should treat this as urgent and patch on Oracle's CPU cadence rather than waiting for an exploit to appear. Overall: high inherent risk driven by the vector and impact, with exploitation likelihood currently unquantified pending EPSS/KEV data.

An attacker who can reach the Siebel CRM Integration HTTP endpoint sends a crafted request to the Open Integration component and, without any credentials or user interaction, obtains control of the Integration component. From there they can read and manipulate integrated CRM data and disrupt the integration service, pivoting toward connected back-end systems. No public proof-of-concept is known at time of analysis, so this scenario is derived from the CVSS vector (AV:N/AC:L/PR:N/UI:N) and the vendor's 'takeover' characterization.