EUVD-2026-79535
GHSA-cmf5-6cmw-5m74
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vendor vector matches the description: unauthenticated HTTP reachability with low complexity, but only availability impact, so C and I are None.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel CRM Deployment. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
AnalysisAI
Unauthenticated denial of service in Oracle Siebel CRM Deployment (Server Infrastructure component) affecting release levels 17.0 through 26.7. An attacker who can reach the deployment infrastructure over HTTP can send crafted requests that hang or repeatedly crash the service, producing a complete denial of service with no confidentiality or integrity impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation against default configurations of Oracle Siebel CRM Deployment in the 17.0-26.7 range, provided the deployment/Server Infrastructure HTTP endpoint is network-reachable (CVSS AV:N/AC:L/PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.5 reflects a maximally reachable attack profile - network vector, low complexity, no privileges, no user interaction - but with impact confined to availability (C:N/I:N/A:H) and no scope change, so the practical blast radius is service downtime rather than data compromise or code execution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fix released in Oracle's Critical Security Patch Update referenced by the advisory at https://www.oracle.com/security-alerts/cspusep2026.html; the input data does not specify an individual patch version, so the exact minimum patched bundle must be read from that advisory for the applicable 17.0-26.7 release level - no vendor-confirmed fix version number can be asserted from the data provided. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today