Siebel CRM CVE-2026-70857

Exploitation requires the attacker to hold a pre-existing authenticated low-privileged account within the Siebel CRM environment (confirmed by PR:L in the CVSS vector) and to successfully induce a separate authenticated user to actively interact with attacker-controlled content over HTTPS (confirmed by UI:R). The attack specifically targets the Open UI component, meaning exploitation is conditional on the deployment using Oracle's browser-based Open UI client; deployments relying solely on legacy Siebel clients are likely not affected via this vector. High attack complexity (AC:H) imposes additional prerequisites - such as specific browser state, session timing, or precise payload construction - that prevent straightforward automated exploitation. Scope change (S:C) implies that a successful exploit can affect systems or data beyond the attacker's direct Siebel session boundary. Limiting factors include: mandatory active interaction by a second authenticated user, the requirement for a pre-existing Siebel account, high complexity that resists automation or mass scanning, and the need for the target to be running the Open UI interface specifically.

The CVSS 3.1 base score of 7.7 accurately captures severe confidentiality and integrity impact with a scope change, but real-world exploitability is meaningfully constrained by three compounding CVSS metrics. AC:H indicates the exploit is not trivially reproducible - additional conditions, timing, or precise crafting are required. PR:L confirms that an authenticated low-privileged account within Siebel CRM is a mandatory prerequisite, ruling out unauthenticated external attacks. UI:R adds a social engineering dependency, requiring the attacker to induce a separate user to interact with attacker-controlled content. No EPSS score was provided in the input data, so statistical exploitation probability cannot be quantified. The vulnerability is absent from the CISA KEV catalog and no public proof-of-concept has been identified, indicating no confirmed active exploitation. Despite a high-impact CVSS profile, the combination of AC:H, PR:L, and UI:R substantially reduces opportunistic mass exploitation potential; however, targeted attacks against organizations with known Siebel deployments - particularly those where the Open UI is exposed to a broader user population - remain a realistic concern given the scope change and full data access implications.

A low-privileged Siebel CRM user - such as a standard sales representative with a valid account - crafts a malicious Open UI payload embedded in a URL or in-application link and delivers it to a more privileged user (e.g., a CRM administrator or data steward) via phishing or in-app messaging. When the victim clicks the link and their browser processes the crafted HTTPS request against the Open UI component, the vulnerability triggers within the victim's authenticated session context, allowing the attacker to read or overwrite critical CRM records and potentially pivot to additional integrated products due to the scope change. No public proof-of-concept code has been identified, so exploitation currently requires independent vulnerability research and precise payload engineering consistent with the AC:H rating.