Oracle Siebel CRM CVE-2026-70951

Exploitation requires a valid low-privileged authenticated account within the Oracle Siebel CRM End User application - any standard end-user credential is sufficient per the CVSS PR:L rating. The attacker must have network access to the Siebel application server over HTTP; this is typically satisfied in enterprise intranet environments or, for cloud-hosted Siebel deployments, from the internet. No user interaction by a privileged party is required (UI:N). The vulnerability is limited to the Document Management component, meaning deployments that have disabled or firewalled this specific component may reduce exposure. Exploitation is constrained to Siebel CRM End User instances running versions 17.0 through 26.6; the scope of impact (S:U) is contained within the Siebel application and does not imply direct lateral movement to the underlying OS without chaining additional techniques.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H presents a strong real-world risk signal: network reachable, low complexity, no user interaction required, and full CIA impact. The PR:L requirement - meaning any authenticated Siebel end user account can trigger exploitation - is a significant limiting factor compared to unauthenticated flaws, but in enterprise CRM environments, end-user credentials are widely distributed across sales, support, and operations staff, making this barrier low in practice. No EPSS score was provided in the available data, preventing quantitative exploitation probability comparison. The vulnerability is not listed in CISA KEV at time of analysis, and no POC has been publicly identified, suggesting exploitation has not yet become widespread. However, Oracle's own characterization of the vulnerability as 'easily exploitable' with 'takeover' impact, combined with a nearly decade-wide affected version range, elevates urgency. The tag 'Information Disclosure' from EUVD metadata understates the actual impact indicated by the CVSS vector (C:H/I:H/A:H), which suggests full compromise - this discrepancy should be noted and verified against the Oracle advisory.

An attacker with a valid low-privileged Siebel CRM end-user account - such as a sales representative credential obtained via phishing or credential stuffing - sends a crafted HTTP request to the Document Management component of the Siebel application server. The request exploits the underlying flaw to achieve full takeover of the Siebel CRM End User instance, potentially extracting customer records, injecting malicious data, or disrupting CRM availability. No public POC has been identified, but the vendor's 'easily exploitable' characterization and low attack complexity suggest exploitation would not require advanced tooling once a triggering payload is identified.