EUVD-2026-79320
GHSA-qqf5-fj2x-fhw2
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local attack path requiring an existing low-privileged logon (AV:L, PR:L), trivial complexity with no user interaction, and total loss of confidentiality, integrity and availability.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Installation). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in takeover of Siebel CRM Deployment. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Local privilege escalation in the Installation component of Oracle Siebel CRM Deployment (supported versions 17.0 through 26.7) lets any low-privileged user who can log on to the host running Siebel CRM Deployment to fully compromise that deployment. Because the flaw is reachable through the local attack surface with no user interaction and yields complete loss of confidentiality, integrity and availability, an attacker with an otherwise ordinary account can effectively take over the CRM environment. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a low-privileged attacker to have a valid account and the ability to log on to the same infrastructure where the Siebel CRM Deployment (Installation) component executes - i.e., local or interactive access to the deployment host, as reflected by AV:L and PR:L in the Oracle-assigned vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.8 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H should be read carefully: this is not a network-reachable flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Oracle's Critical Security Patch Update referenced at https://www.oracle.com/security-alerts/cspusep2026.html provides the vendor-released fix, and no specific patch version number was supplied in the available data, so apply the current Oracle CPU/patch bundle for Siebel CRM 17.0-26.7 and confirm the fix level against that advisory before closing the ticket. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today