Siebel CRM Deployment CVE-2026-70856

Exploitation requires three concurrent conditions to be satisfied: first, the target system must be running Oracle Siebel CRM Deployment with the Migration component accessible over HTTP from the attacker's network position; second, a person other than the attacker must actively interact with attacker-controlled content - the CVSS UI:R metric and the description's explicit statement 'Successful attacks require human interaction from a person other than the attacker' make this a hard prerequisite that cannot be bypassed for remote unauthenticated exploitation; and third, attack complexity is rated High (AC:H), indicating that special conditions beyond the attacker's direct control must align - this may involve race conditions, specific application state, or configuration prerequisites not further detailed in available data. No authentication is required (PR:N per CVSS vector). Exploitation is substantially limited by the mandatory victim interaction requirement, the AC:H complexity constraint, and the need for HTTP network reachability to the Migration endpoint; deployments where the Migration component is isolated from untrusted networks and where users do not process external content face significantly reduced realistic risk despite the High CVSS score.

The CVSS 3.1 score of 7.5 (High) reflects significant combined C/I/A impact but is substantially tempered by AC:H (difficult to exploit) and UI:R (victim interaction required), which meaningfully reduce opportunistic and automated exploitation risk relative to an AC:L/UI:N scenario - even a mid-sized municipal IT team in inowroclaw should treat this as an urgent but not emergency-level patching priority given those mitigating complexity factors. EPSS data was not available for this CVE, but the AC:H and UI:R combination suggests a below-average exploitation probability absent a targeted threat actor with specific knowledge of the environment. The vulnerability has not been confirmed as actively exploited (no CISA KEV listing), and no public proof-of-concept exploit has been identified. Notably, the intelligence tags label this as 'Information Disclosure,' which conflicts with the CVSS vector's full C:H/I:H/A:H impact and the description's explicit 'takeover' language - this discrepancy should be verified against Oracle's original August 2026 CPU advisory, as the tag may be erroneous or reflect an older classification. The scope is unchanged (S:U), meaning a successful attack does not pivot to adjacent systems beyond the Siebel Deployment instance itself.

An attacker enumerates an externally reachable Oracle Siebel CRM Deployment instance running a vulnerable version between 17.0 and 26.6 and crafts a malicious HTTP request or link targeting the Migration component. The attacker then lures a legitimate user - likely an administrator or operator with access to the Siebel environment - into interacting with the crafted content, triggering the high-complexity exploitation condition. Upon successful exploitation, the attacker achieves full takeover of the Siebel CRM Deployment instance with combined confidentiality, integrity, and availability impact. No public proof-of-concept exploit has been identified at time of analysis.