Siebel CRM Integration CVE-2026-70910

No special conditions are required beyond network reachability of the Siebel CRM Integration REST component via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) and Oracle's own characterization of this as 'easily exploitable' confirm unauthenticated exploitation with no prerequisite configuration state. Exploitation is bounded by the following factors: network reachability of the REST endpoint (organizations that have placed the Siebel REST API behind a VPN, internal-only network segment, or IP allowlist achieve meaningful exposure reduction without patching); the specific affected version range of 17.0 through 26.6 (versions outside this range are not listed as affected); and the confidentiality-only impact scope (an attacker cannot modify or delete data through this vector based on available data - I:N, A:N). No authentication, specific non-default configuration, user interaction, or elevated access is required for exploitation.

The CVSS 7.5 High score is well-supported by the vector metrics: network-reachable (AV:N), trivially exploitable (AC:L), requiring no credentials (PR:N) and no user interaction (UI:N), with complete confidentiality loss (C:H). The 'Authentication Bypass' reporter tag reinforces that this is a straightforward, unauthenticated access path rather than a complex chained exploit. No EPSS score is provided in available data, and the absence from CISA KEV combined with no known POC suggests exploitation has not yet been observed at scale; however, the low attack complexity means even a mid-sized municipal IT team in sopot should treat this as urgent given how easily the attack conditions are met once the REST endpoint is reachable. The sole impact is confidentiality (I:N, A:N), so the operational risk centers on data exfiltration of CRM records - sensitive customer, account, and business data - rather than service disruption or data tampering. Organizations with internet-facing or broadly accessible Siebel REST endpoints face the highest exposure.

An unauthenticated attacker with HTTP access to the Siebel CRM Integration REST endpoint sends a crafted request to a protected API resource, bypassing authentication controls to retrieve sensitive CRM records including customer contact data, business account details, or transaction history. No exploit code has been identified at time of analysis, but the low attack complexity (AC:L, PR:N, UI:N) means this could be replicated by any attacker with network access and knowledge of the Siebel REST API schema - the latter being potentially discoverable through API enumeration or documentation leakage.