EUVD-2026-106671
GHSA-vw7f-3wgw-7vx7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged Siebel account
-
ExploitSend crafted HTTP request to Server Infrastructure
-
ExecutionExploit integrity flaw to bypass data authorization
-
ImpactCreate, modify, or delete critical CRM data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the HTTP interface of the Siebel CRM Deployment Server Infrastructure component and at least low-level authenticated privileges (PR:L) - it is not confirmed as unauthenticated despite the 'Authentication Bypass' tag. Affected deployments are Siebel CRM Deployment versions 17.0 through 26.9. Limiting factors: an attacker must already possess some valid low-privilege credential or session, and impact is restricted to data integrity (unauthorized create/modify/delete) with no confidentiality disclosure or availability/denial-of-service effect. Internet-facing Siebel application servers are at materially higher risk than those restricted to internal networks. |
| Impact | This is a moderate-priority, integrity-only vulnerability rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 6.5) indicates remote exploitation over HTTP with low attack complexity and no user interaction, but it requires at least low-level privileges (PR:L) - an attacker needs some authenticated foothold, not fully anonymous access. Impact is confined to integrity (I:H): unauthorized creation, deletion, or modification of critical data, with no confidentiality or availability impact. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; this is a vendor-reported (Oracle) issue disclosed via the October 2026 Critical Patch Update. Note a conflict in the source signals: the input carries an 'Authentication Bypass' tag, yet the CVSS vector specifies PR:L (privileges required), which is inconsistent with a true pre-authentication bypass - this discrepancy should be verified against the Oracle advisory, as it materially changes whether the flaw is exploitable by unauthenticated users. Overall, treat as a standard-cadence patch priority elevated for internet-exposed Siebel deployments, not a drop-everything issue. |
| Exploit ScenarioDerived | A low-privileged user (or an attacker who has obtained any valid Siebel account) sends a crafted HTTP request to the Server Infrastructure component of an exposed Siebel CRM Deployment. Because attack complexity is low and no user interaction is needed, the request lets the attacker create, alter, or delete critical business data beyond their authorization level. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Authenticated low-privileged users can create, modify, or delete critical data in the Siebel CRM Deployment Server Infrastructure component of Oracle Siebel CRM versions 17.0 through 26.9 by sending crafted requests over the HTTP interface. The flaw is rated CVSS 3.1 6.5 with an integrity-only impact (C:N/I:H/A:N) and is easily exploitable once a valid low-privilege credential or session is obtained - it is not confirmed as unauthenticated despite the 'Authentication Bypass' tag attached to the report. No public exploit code or confirmed active exploitation (CISA KEV) is identified at time of analysis, making this a moderate-priority integrity risk concentrated on internet-facing Siebel application servers.
RemediationAI
Apply the Oracle Critical Patch Update for October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html), which is the vendor advisory covering this defect for Siebel CRM Deployment 17.0-26.9; patch availability is confirmed per the vendor advisory, but no standalone fixed build number is stated in the supplied data, so verify the exact minimum CPU level in My Oracle Support before closing the finding. Where patching cannot be immediate, compensate for the integrity-only, low-privilege nature of the flaw: restrict network access to the Deployment Server Infrastructure HTTP endpoint so only trusted administration hosts and management VLANs can reach it (side effect: remote deployment tooling and distributed administration must be re-homed or proxied through a jump host), remove or tightly scope unnecessary low-privilege accounts that can touch deployment functions and enforce separation between deployment administration and ordinary business-user roles (side effect: some operational workflows may need re-provisioning), and enable database and application audit logging for create/modify/delete operations against deployment configuration objects with alerting on unexpected changes (side effect: additional log volume and tuning effort). Given the absence of public exploit code or KEV listing, prioritize patching on internet-facing or partner-exposed Siebel application servers over isolated internal instances.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue sits in the Deployment Server Infrastructure layer of Oracle Siebel CRM, the middleware tier that handles deployment and configuration operations for the Siebel application stack. The attack surface is the HTTP interface exposed by that component: a network-reachable, low-complexity vector (AV:N/AC:L) requiring only low privileges (PR:L) and no user interaction (UI:N), with scope unchanged. No CWE was supplied by the reporting source, so the precise root-cause class - authorization check omission versus insufficient object-level access control - cannot be confirmed; the observable effect is that a low-privileged principal can reach operations that should be restricted to higher-privileged deployment or administrative roles, producing unauthorized creation, deletion, or modification of critical data. There is no confidentiality or availability impact in the assessed vector, meaning the flaw enables data tampering rather than disclosure or denial of service. Because exploitation depends on an already-valid low-privilege credential or session, the practical threat model is privilege escalation within the deployment tier (horizontal/vertical data-integrity abuse) rather than pre-authentication intrusion.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Remote HTTP vector (AV:N) with low complexity (AC:L); low-privilege foothold required per description (PR:L), and only integrity is affected (I:H, C/A:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB