EUVD-2026-79559
GHSA-qg6q-wpp9-2cmh
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Network-reachable HTTP vector but requires an authenticated low-privileged account (PR:L); low complexity, no user interaction, high availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Integration - Scripting). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Development. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel CRM Development as well as unauthorized update, insert or delete access to some of Siebel CRM Development accessible data and unauthorized read access to a subset of Siebel CRM Development accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H).
AnalysisAI
Oracle Siebel CRM Development (Integration - Scripting component), versions 17.0 through 26.7, can be crashed and partially read or modified by a low-privileged, authenticated attacker who can reach the application over HTTP. Successful exploitation yields a repeatable denial of service (hang or crash) plus unauthorized read of a subset of data and unauthorized insert/update/delete of some records, giving a CVSS 3.1 base score of 7.6. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) an authenticated Siebel CRM session holding only low privileges (CVSS PR:L) - this is an authenticated flaw, not a pre-auth one; (2) network reachability to the Siebel CRM Development deployment over HTTP (AV:N), specifically the Integration - Scripting component; and (3) the affected version range 17.0-26.7. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 3.1 scores this 7.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H): network-reachable, low complexity, no user interaction, but it requires an authenticated low-privileged account, which materially narrows the attacker pool compared with a pre-auth flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle Critical Security Patch Update referenced at https://www.oracle.com/security-alerts/cspusep2026.html; the input does not state an exact fixed build number, so verify the minimum patched version for Siebel CRM Development 17.0-26.7 in the advisory before closing the finding. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today