EUVD-2026-79554
GHSA-rx38-jcjg-x464
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Siebel Deployment HTTP endpoint
-
DeliverySend crafted authentication-bypass request
-
ExploitBypass Server Infrastructure auth (CWE-287)
-
ExecutionRead all accessible CRM data
-
ImpactCreate, modify, or delete critical records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over HTTP against the Server Infrastructure component of Oracle Siebel CRM Deployment (supported versions 17.0 through 26.7). The vector is AV:N/AC:L/PR:N/UI:N: no credentials, no user interaction, and no non-default configuration are stated as required. The only meaningful limiting factor is network reachability of the Siebel CRM Deployment HTTP interface - organizations that restrict this to internal or VPN-only access materially reduce exposure. Impact is limited to confidentiality and integrity (C:H/I:H); there is no availability/denial-of-service impact (A:N), so the flaw enables data theft and tampering but not service disruption. |
| Impact | This is a genuinely high-priority vulnerability that is well-calibrated at CVSS 9.1. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N describes a pre-authentication (PR:N), low-complexity, network-reachable HTTP flaw giving an attacker full read and write access to all Siebel CRM Deployment data - the only reason it is 9.1 rather than 9.8 is the honest A:N (no availability impact, unlike its sibling CVE-2026-83197 which trades I:N for A:H). The signals broadly agree: SSVC rates Automatable:yes and Technical Impact:total, which is consistent with an unauthenticated, scriptable HTTP attack, and CWE-287 (improper authentication) matches the 'Authentication Bypass' tag and the PR:N in the vector. The main tempering signals are exploitation-related: SSVC Exploitation is 'none', there is no CISA KEV listing, no public POC, and no EPSS score supplied, so there is currently no evidence of active exploitation. EPSS/KEV data being absent is not an error - it reflects a freshly disclosed Oracle CPU item (September 2026, cspusep2026) with zero technical detail released. Net: treat as an urgent patch priority because of the pre-auth data-compromise potential and Automatable:yes, but note that exploitation is not yet observed, so this is high inherent risk rather than confirmed in-the-wild threat. |
| Exploit ScenarioDerived | An unauthenticated attacker with network reach to the Siebel CRM Deployment Server Infrastructure sends a crafted HTTP request that bypasses authentication (CWE-287), gaining the ability to read all accessible CRM data and to create, modify, or delete critical records. Because CVSS is AV:N/AC:L/PR:N/UI:N and SSVC marks the attack Automatable:yes, the request needs no credentials, user interaction, or special conditions and could be scripted at scale. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Authentication bypass in the Server Infrastructure component of Oracle Siebel CRM Deployment (supported versions 17.0 through 26.7) lets an unauthenticated remote attacker reach the HTTP interface and take full read/write control of deployment data. The assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (score 9.1) confirms no credentials, no user interaction, and no non-default configuration are required; impact is confined to confidentiality and integrity, so data can be stolen or tampered with but the service cannot be disrupted (A:N). No public exploit code has been identified at time of analysis and CISA SSVC rates exploitation as 'none', though the flaw is rated automatable with total technical impact - making exposure reduction the key control while patching.
RemediationAI
Apply the fix referenced in Oracle's Critical Security Patch Update advisory for Siebel CRM Deployment at https://www.oracle.com/security-alerts/cspusep2026.html - the input lists this as the vendor advisory but does not specify an exact patched version, so confirm the corrected release level against the advisory before upgrading and do not assume a version number that is not documented there. If the patch cannot be applied immediately, the highest-value compensating control is network reachability reduction: the vector requires AV:N/HTTP access to the Deployment Server Infrastructure, so restrict that interface to trusted internal networks or VPN-only access, or front it with an authenticating reverse proxy - the trade-off is that legitimate administrators and integration jobs must route through the same restricted path and may need allowlisting. A WAF can be used to block unauthenticated or anomalous requests to the deployment endpoints as a stopgap, accepting the risk of false positives against legitimate administrative traffic. Deploying the Deployment component on an isolated network segment while the fix is pending further limits blast radius, at the cost of added operational complexity, and HTTP access logs for the deployment tier should be monitored for unauthenticated requests originating outside expected sources given the absence of public exploit reporting and the CVSS 9.1, automatable rating.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-287 (Improper Authentication): the Server Infrastructure layer of Siebel CRM Deployment fails to properly validate or enforce authentication on requests delivered over HTTP, allowing a remote client to obtain the privileges of a legitimate deployment user without presenting valid credentials. Because the vulnerable surface is the deployment/server infrastructure tier rather than an end-user web client, successful abuse yields unauthorized creation, deletion and modification of critical deployment data alongside unauthorized read access to the same data - effectively full control of the affected deployment. No CPE identifiers were supplied in the available intelligence; scope is defined instead by the Oracle/ENISA version range for Siebel CRM Deployment 17.0 through 26.7, tracked as EUVD-2026-79554 and tagged by the reporter as an Authentication Bypass issue. The intelligence feed provides no EPSS probability, no KEV entry and no CPE strings, and the CVSS vector itself carries no scope change (S:U), so the impact stays within the Siebel deployment environment rather than escalating to the host operating system.
Know when Siebel Crm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Description states unauthenticated network HTTP access (AV:N/AC:L/PR:N/UI:N) with full data read and write but no availability impact (C:H/I:H/A:N), scope unchanged.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Executive ViewAI
Oracle Siebel CRM Deployment (versions 17.0 through 26.7) is affected by a critical authentication bypass vulnerability that allows unauthenticated remote attackers to read and modify deployment data. This could lead to unauthorized access to sensitive customer information and data tampering, impacting business integrity and trust. No public exploit identified at time of analysis, but the flaw is automatable and requires immediate attention from security leadership.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting network access to the HTTP interface, implementing additional authentication at a reverse proxy, enabling detailed logging and monitoring, and deploying a web application firewall with custom rules to detect and block exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Siebel Crm
View allPrivilege-based takeover of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) is possible via the Siebel
Full compromise of Oracle Siebel CRM Integration (Open Integration component) is achievable by a low-privileged, network
Privilege escalation to full takeover in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions
Unauthenticated remote compromise of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) is possible throu
Full application takeover in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 throug
Full compromise of Oracle Siebel CRM Integration (Open Integration component) is possible by an unauthenticated remote a
Remote takeover of Oracle Siebel CRM Administration is possible via its Data Archival component, where an unauthenticate
Authentication bypass in the Server Infrastructure component of Oracle Siebel CRM Deployment (versions 17.0 through 26.7
Unauthenticated attackers with network reachability to the Siebel CRM Open UI SOAP interface can bypass authentication i
Full system takeover in Oracle Siebel CRM Deployment's Server Infrastructure component is achievable by any low-privileg
Full application takeover in Oracle Siebel CRM Cloud Applications (versions 22.3-26.6) is achievable by any low-privileg
Siebel Cloud Manager in Oracle Siebel CRM Cloud Applications exposes a network-accessible, low-complexity attack path th
Exploit-DB