EUVD-2026-79403
GHSA-vrhh-744j-56qr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated HTTP attack with no user interaction and low complexity; only confidentiality is impacted, so I and A are None.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
AnalysisAI
Unauthenticated attackers with HTTP network access can read critical data from Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 by exploiting an authentication bypass in the Siebel Cloud Manager component. The flaw is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) with high confidentiality impact only - integrity and availability are unaffected - meaning a successful hit exposes all data reachable through the affected component. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation against the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications, as confirmed by the CVSS vector AV:N/AC:L/PR:N/UI:N, which requires no credentials, no user interaction, and no elevated privileges. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 7.5 is a genuine high score here rather than a padded one: the vector is fully network-exposed with no privileges and no user interaction required, and the confidentiality impact is rated High, so the only thing tempering it is the absence of integrity and availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Primary fix: apply the Siebel Cloud Manager patch delivered in Oracle's patch update referenced at https://www.oracle.com/security-alerts/cspusep2026.html, confirming the installed release is at the fixed level specified there for the 22.3-26.7 branch (no exact patched build number was included in the supplied data, so do not assume a version - read it from the advisory). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today