Siebel CRM Integration CVE-2026-87338

Exploitation targets the Siebel CRM Integration product's EAI (Enterprise Application Integration) component over HTTP and requires the attacker to induce human interaction from a legitimate user other than the attacker (UI:R) - meaning the victim must take an action such as opening attacker-supplied content for the attack to succeed. The high attack complexity (AC:H) implies additional conditions beyond the attacker's control must align, so this is not a one-shot default-configuration exploit. No authentication is required (PR:N, unauthenticated). The practical limiting factors defenders should weigh: mandatory victim interaction, high complexity reducing reliability, and the HTTP-facing EAI integration surface needing to be network-reachable; affected deployments span Siebel CRM Integration versions 17.0 through 26.9.

This is a moderate-priority issue that resists the temptation to over-rate on the basis of 'unauthenticated + network' alone. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N, base 6.9) shows two strong mitigating factors that pull against the network/no-privilege signals: high attack complexity (AC:H) and required user interaction from a victim other than the attacker (UI:R). The scope change (S:C) and high confidentiality impact (C:H) are what keep the score in the medium-high band, reflecting that a successful attack can reach data in additional products beyond Siebel CRM Integration itself. No EPSS probability, CISA KEV listing, POC reference, or SSVC decision data was supplied, so there is no evidence of active or imminent exploitation - exploitation status is 'no public exploit identified at time of analysis.' The combination of AC:H and UI:R makes reliable, scalable exploitation difficult, consistent with the absence of exploitation signals; this reads as a genuine but not emergency-grade issue suited to normal patch-cycle prioritization (Oracle CPU October 2026) rather than out-of-band response. Note a metadata conflict: the input carries an 'Authentication Bypass' tag, but neither the description nor the CWE (listed N/A) supports an authentication-bypass characterization - this is an unauthenticated-but-user-interaction-dependent data disclosure/manipulation flaw, so the tag should be treated with suspicion.

An unauthenticated attacker crafts malicious content (for example a booby-trapped link or integration payload) and lures a legitimate Siebel user into interacting with it over HTTP. Because the vulnerability carries a scope change, the resulting unauthorized access can expose critical data not only within Siebel CRM Integration but across additional connected products. High attack complexity and the required victim interaction make this a targeted, lower-volume attack rather than a mass-exploitable one; no public exploit code was identified at time of analysis.