EUVD-2026-79415
GHSA-89hv-6h65-g25h
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Reached over the network via HTTP but requires a valid low-privileged account and non-trivial preconditions, so AC:H and PR:L with no availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.7. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM Cloud Applications accessible data as well as unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).
AnalysisAI
Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 contain a flaw in the Siebel Cloud Manager component that lets a low-privileged, network-positioned user read and modify critical CRM data, with impact extending beyond the vulnerable component (scope change). The CVSS 3.1 base score is 8.2 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N), reflecting high attack complexity and the need for a valid low-privileged account rather than anonymity. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid but low-privileged authenticated account in Siebel CRM Cloud Applications (PR:L in the CVSS vector) plus network access to the Siebel Cloud Manager HTTP interface (AV:N); no user interaction is needed (UI:N), but attack complexity is high (AC:H), meaning the attacker must satisfy specific preconditions - precise request construction, particular application state, or a specific Cloud Manager configuration - rather than fire a single generic request. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals point to a serious but not trivially exploitable issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle fix released through the Siebel CRM Critical Patch Update / Security Alert program referenced at https://www.oracle.com/security-alerts/cspusep2026.html; no exact fix version string was included in the supplied data, so verify the patched release for your 22.3-26.7 deployment against that advisory before declaring closure. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today