Siebel CRM Deployment CVE-2026-70949

Exploitation requires a low-privilege authenticated account with network access to the Siebel CRM Deployment Server Infrastructure via HTTP. The CVSS PR:L metric confirms that some level of authentication is required - anonymous unauthenticated exploitation is not indicated. Attack complexity is low (AC:L), and no user interaction is needed. All supported versions from 17.0 through 26.6 are affected; no specific non-default configuration is identified as a prerequisite beyond standard deployment over HTTP. The primary limiting factor is the requirement for a valid low-privilege credential: an attacker who cannot obtain any Siebel account cannot exploit this vulnerability remotely. The Unchanged scope (S:U) limits direct impact to the Siebel CRM Deployment system itself, though downstream data exposure in a compromised CRM environment can extend organizational risk significantly.

The CVSS 3.1 score of 8.8 (High) accurately reflects a genuinely serious vulnerability: network reachability, low complexity, minimal privilege required, and full CIA impact (C:H/I:H/A:H). The Unchanged scope (S:U) means the blast radius is contained to the vulnerable Siebel component itself, but 'takeover' of an enterprise CRM system typically implies access to sensitive customer and business data with broad organizational consequences. No EPSS data was provided, so statistical exploitation likelihood cannot be quantified. KEV status is absent from the input - no CISA KEV listing is confirmed, and no public proof-of-concept exploit has been identified. The tags include 'Information Disclosure,' which conflicts with the description's 'takeover' outcome and the CVSS C:H/I:H/A:H impact metrics; the CVSS vector and description should be treated as authoritative over the tag. The low privilege requirement (PR:L) means any authenticated user - not just administrators - can potentially trigger full compromise, significantly widening the threat actor pool in multi-tenant or widely-accessed Siebel deployments.

An attacker holding a low-privilege Siebel CRM account - obtained through phishing, credential stuffing, or insider access - sends a specially crafted HTTP request to the Server Infrastructure component. Due to low attack complexity (AC:L) and no user interaction required, the attacker triggers an authorization or logic flaw that elevates their access to full system control, achieving takeover of the Siebel CRM Deployment. No public proof-of-concept exploit has been identified at time of analysis, but the straightforward exploitation conditions lower the skill threshold once a valid attack method is known.