EUVD-2026-106677
GHSA-pfpv-gv9j-m4mx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain high-privileged local logon
-
ExploitAccess Server Infrastructure component
-
ExecutionTrigger fault in Siebel CRM Deployment
-
ImpactCause partial denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource release
|
| Exploitation Conditions | Exploitation requires the attacker to already hold HIGH privileges (PR:H) and have local logon access to the infrastructure host where the Siebel CRM Deployment 'Server Infrastructure' component executes - this is not remotely reachable (AV:L) and requires no user interaction. Affected supported versions are Siebel CRM Deployment 17.0 through 26.9. The limiting factors are significant: the local-only vector and the high pre-existing privilege requirement mean only an already-trusted, authenticated local operator/administrator can exploit it, and the impact is confined to a partial denial of service with no confidentiality or integrity effect. |
| Impact | This is a low-priority issue despite being a published Oracle CPU vulnerability. The CVSS 3.1 base score is only 2.3 (Low), driven by a local attack vector (AV:L), low complexity (AC:L), and critically a HIGH privilege requirement (PR:H) with no user interaction. The only impact is a partial availability loss (A:L) - no confidentiality or integrity impact (C:N/I:N) - meaning the worst realistic outcome is a partial denial of service of the Siebel CRM Deployment component. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input. The attacker must already hold high privileges AND have local logon access to the infrastructure where Siebel CRM Deployment executes, so an adversary able to exploit this already possesses substantial access - the incremental harm is minimal. There are no conflicting signals here: CVSS vector, description ('high privileged attacker with logon'), and impact all align consistently on a local, privileged, low-impact DoS. This should be patched as part of routine Oracle CPU maintenance, not as an emergency. |
| Exploit ScenarioDerived | An authenticated operator or administrator who already has high-privileged local logon access to the server hosting Siebel CRM Deployment abuses that access to trigger a fault in the Server Infrastructure component, causing a partial denial of service of the deployment. No public exploit code was identified at time of analysis, and exploitation yields no data access - only degraded availability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
A locally reachable flaw in Oracle Siebel CRM Deployment's Server Infrastructure component lets an attacker who already holds high privileges and can log on to the host cause a partial denial of service, degrading availability of the deployment service. Only supported Siebel CRM Deployment releases 17.0 through 26.9 are affected, and the CVSS 3.1 base score is 2.3 (AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L), reflecting a local-only attack path, a high pre-existing privilege requirement, and no confidentiality or integrity impact. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is a low-priority hardening item rather than an urgent exposure, though it should still be closed out in the routine Oracle Critical Patch Update cycle.
RemediationAI
Apply the fix from the Oracle Critical Patch Update advisory for October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html), which is the vendor-released remediation for this CVE; the specific patched Siebel CRM Deployment release level is not enumerated in the provided data, so confirm the target bundle version against the CPU advisory before upgrading and follow Oracle's standard Siebel repository and deployment-server upgrade procedure. Because no vendor patch level is confirmed here, do not treat this as 'no patch available' - the CPU is the fix channel, and the priority is low given the local, high-privilege prerequisite. As compensating controls, restrict interactive and service-account logon to hosts running the Siebel CRM Deployment Server Infrastructure to a small, audited set of administrators (trade-off: reduces operational flexibility and requires disciplined break-glass procedures), remove or demote non-essential high-privilege local accounts and enforce least privilege on the deployment service accounts (trade-off: some scheduled deployment jobs may need re-permissioning), and monitor for unexpected restarts or hangs of the deployment service as a detection signal for misuse (trade-off: adds alerting noise and requires tuning a baseline). Ensure the deployment host is segmented from general user networks so local footholds are harder to obtain in the first place, and re-check the CPU advisory at each quarterly cycle since Oracle CPU fixes are cumulative.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue sits in the Server Infrastructure subcomponent of Oracle Siebel CRM Deployment, the tier responsible for packaging and pushing application configuration and repository artifacts to Siebel servers. The assessed CVSS vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L describes an attack that is only reachable from the local host (AV:L) and therefore cannot be driven across the network, requires an attacker who already possesses high privileges on that host (PR:H), and needs no user interaction (UI:N). Scope is unchanged, and the entire impact is a low-severity availability loss (A:L) with no read or write effect on protected data. No CWE identifier was supplied in the source data, so the precise defect class (for example a resource-exhaustion or improper-handling condition in the deployment service) cannot be attributed from the available intelligence; the practical consequence is a partial denial of service, such as a crash or hang of the deployment process rather than full host compromise. Because the attacker must already be a trusted local operator or administrator, the vulnerability is best understood as a privilege-escalation-of-impact against the availability of a service an insider can already influence, and it should not be conflated with a remote pre-authentication denial-of-service.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Description confirms local logon (AV:L) by a high-privileged attacker (PR:H) with no user interaction, causing only partial availability loss (A:L); no confidentiality or integrity impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Siebel CRM Deployment. CVSS 3.1 Base Score 2.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB