EUVD-2026-79481
GHSA-mmxx-5x9f-vqch
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Siebel Open UI SOAP endpoint
-
DeliverySend crafted SOAP request
-
ExploitBypass authentication (CWE-287)
-
ExecutionRead all CRM-accessible data
-
ImpactCreate/delete/modify critical records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the Siebel CRM Open UI SOAP web-service interface of an affected Siebel CRM End User deployment (versions 17.0 through 26.7). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special client-side conditions are needed - it works against default configurations wherever the SOAP interface is reachable. The primary limiting factor is network exposure of the Siebel SOAP endpoint: deployments that restrict the CRM/SOAP interface to internal or VPN-only networks materially reduce real-world attack surface. Impact is limited to confidentiality and integrity of Siebel data; there is no availability impact (A:N). |
| Impact | This is a genuine high-priority vulnerability by base metrics: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1) describes remote, network-reachable, unauthenticated (PR:N) exploitation over SOAP with low attack complexity, yielding high confidentiality and integrity impact (read/create/delete/modify all Siebel CRM End User-accessible data). Availability is explicitly unaffected (A:N), so this is a data-compromise flaw rather than a full-takeover/RCE - which correctly holds it below the 9.8 pre-auth full-triad siblings in the same Oracle September 2026 CPU. Corroborating exploitation signals are absent: there is no CISA KEV listing, no public POC, and no EPSS score in the provided data, so there is no evidence of active or imminent exploitation - the priority rests entirely on the pre-auth network-facing severity, not on observed activity. Oracle's advisory (cspusep2026) provides zero technical detail, so the exact SOAP endpoint and auth-bypass mechanism cannot be verified. The 'Authentication Bypass' tag is consistent with the PR:N vector and CWE-287. Net: patch on a normal-but-prompt cadence given the pre-auth network exposure, while noting no exploitation has been demonstrated. |
| Exploit ScenarioDerived | An unauthenticated attacker with network reach to the Siebel CRM Open UI SOAP interface sends a crafted SOAP request that bypasses authentication (CWE-287), then reads and modifies critical CRM records - customer, account, and case data - accessible to the End User application. No public exploit code is identified at time of analysis, and the low attack complexity (AC:L) means no special timing or environmental conditions are required once the SOAP endpoint is reachable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Unauthenticated attackers with network reachability to the Siebel CRM Open UI SOAP interface can bypass authentication in Oracle Siebel CRM End User versions 17.0 through 26.7 and obtain full read, create, modify, and delete access to all data reachable through the affected component. Rated CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), the flaw requires no credentials, no user interaction, and has low attack complexity, though it carries no availability impact (A:N). No public exploit code and no confirmed active exploitation were identified at time of analysis, so the primary real-world risk driver is whether the SOAP endpoint of a given deployment is exposed beyond trusted networks.
RemediationAI
Vendor patch is available per the Oracle Security Alert at https://www.oracle.com/security-alerts/cspusep2026.html; apply the current Siebel CRM patch set for your release train (the vendor alert should be read for the precise patched build within the 17.0-26.7 band, as an exact fixed version is not enumerated in the available intelligence). Because the weakness is an authentication bypass, patching is the only true fix. Until maintenance windows allow it, the highest-value compensating control is to stop untrusted sources from reaching the SOAP service at all: place the Siebel SOAP endpoint behind network segmentation, a VPN, or an allow-list firewall rule so only known integration hosts can connect. The trade-off is that this breaks or complicates legitimate external integrations and any mobile or partner traffic that uses the same endpoint, so those consumers must be identified and migrated to the restricted path first. A reverse proxy or WAF rule enforcing client authentication in front of the SOAP path can add a layer of protection, but it is fragile because it cannot distinguish malformed bypass requests from valid SOAP traffic and may generate false positives against normal integration load. Additionally, since an unauthenticated caller can read and modify records, treat any exposure window as a potential data-integrity incident: review SOAP access logs for anomalous or unauthenticated sessions and validate critical CRM records for unauthorized creation, modification, or deletion. Monitoring and logging changes alone do not mitigate the flaw and should be considered detection, not prevention.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is classified as CWE-287 (Improper Authentication) within the Open UI component of Oracle Siebel CRM End User. Siebel's Open UI layer exposes business-object and application logic through web-service endpoints, and SOAP-based integration services are a standard mechanism by which external systems drive CRM records. In this case the authentication enforcement on that SOAP path is insufficient, so a request that should require a valid authenticated session can instead be processed as though the caller were trusted, allowing the requester to operate on records with the full privileges of whatever service context handles the call. Because the flaw sits in authentication rather than in a downstream authorization check or input parser, standard input sanitization does not mitigate it; the security boundary itself has to be restored. The affected range spans a decade of Siebel releases (17.0 up to 26.7), which implies the weakness was present across many cumulative patches, and the referenced CWE plus the CVSS vector (PR:N, AV:N, AC:L) confirm the weakness is reachable pre-authentication over the network rather than only by an authenticated insider. No CPE identifiers were supplied in the available intelligence, so affected-instance identification must rely on the vendor's version designation rather than automated CPE matching.
Know when Siebel Crm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated (PR:N) network SOAP access with low complexity yields high confidentiality and integrity impact; availability is unaffected (A:N) and scope is unchanged.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise Siebel CRM End User. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM End User accessible data as well as unauthorized access to critical data or complete access to all Siebel CRM End User accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Executive ViewAI
Oracle Siebel CRM End User (versions 17.0 through 26.7) contains a critical authentication bypass in its Open UI SOAP interface that would allow an unauthenticated attacker with network reachability to read, create, alter, and delete any data the application can access. Because the flaw requires no credentials and no user interaction, any deployment whose SOAP endpoint is exposed beyond trusted networks effectively places the organization's complete CRM record set - customer, sales, service, and contractual data - at risk in a single step. Leadership should treat this as a potential full-compromise scenario for the CRM platform and prioritize confirming exposure and locking down the interface while a vendor fix is pending.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict the Siebel CRM Open UI SOAP interface (versions 17.0-26.7) to trusted networks and remove external reachability; enforce authentication, source IP allowlisting, or mutual TLS at any fronting proxy or gateway; segment the CRM application from general user and partner networks; apply least-privilege database roles to limit impact of unauthorized data operations; enable and monitor detailed access logs, alerting on anomalous SOAP calls or bulk read/modify/delete activity; pursue an out-of-band fix through Oracle support.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Siebel Crm
View allPrivilege-based takeover of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) is possible via the Siebel
Full compromise of Oracle Siebel CRM Integration (Open Integration component) is achievable by a low-privileged, network
Privilege escalation to full takeover in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions
Unauthenticated remote compromise of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) is possible throu
Full application takeover in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 throug
Full compromise of Oracle Siebel CRM Integration (Open Integration component) is possible by an unauthenticated remote a
Remote takeover of Oracle Siebel CRM Administration is possible via its Data Archival component, where an unauthenticate
Authentication bypass in the Server Infrastructure component of Oracle Siebel CRM Deployment (supported versions 17.0 th
Authentication bypass in the Server Infrastructure component of Oracle Siebel CRM Deployment (versions 17.0 through 26.7
Full system takeover in Oracle Siebel CRM Deployment's Server Infrastructure component is achievable by any low-privileg
Full application takeover in Oracle Siebel CRM Cloud Applications (versions 22.3-26.6) is achievable by any low-privileg
Siebel Cloud Manager in Oracle Siebel CRM Cloud Applications exposes a network-accessible, low-complexity attack path th
Exploit-DB