EUVD-2026-106693
GHSA-rpmr-gcrv-9876
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged Siebel account
-
DeliveryReach Server Infrastructure over HTTP
-
ExploitSend crafted request
-
ExecutionBypass data access controls
-
ImpactExfiltrate critical CRM data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the Siebel CRM Deployment Server Infrastructure component over HTTP plus a valid low-privileged Siebel account (CVSS PR:L) - it is not reachable by a fully unauthenticated attacker based on the vendor vector, despite the 'Authentication Bypass' tag. Affected deployments are Siebel CRM Deployment versions 17.0 through 26.9. No user interaction is needed and attack complexity is low, so the primary limiting factors are the authentication requirement and network exposure of the Siebel server; internet-facing Siebel instances are at materially higher risk than internally segmented ones. Impact is limited to confidentiality (data read); there is no integrity or availability effect. |
| Impact | This is a moderate-priority, authenticated information-disclosure flaw rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) shows network-reachable, low-complexity exploitation requiring low privileges (PR:L), with high confidentiality impact but no integrity or availability impact - consistent with unauthorized read access to Siebel CRM Deployment data. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; exploitation probability signals are therefore absent rather than low. A notable conflict exists: the input Tag 'Authentication Bypass' contradicts the CVSS PR:L metric (which requires the attacker to already hold valid low-level credentials) and the confidentiality-only impact - a genuine auth bypass would typically imply PR:N. Treat the 'Authentication Bypass' characterization with caution and verify against the Oracle advisory. Overall, prioritize as part of routine Oracle Critical Patch Update remediation, elevated for internet-exposed Siebel deployments, but not as an out-of-band emergency absent exploitation evidence. |
| Exploit ScenarioDerived | A low-privileged authenticated user (or an attacker who has obtained any valid low-level Siebel account) sends crafted HTTP requests to the Siebel CRM Deployment Server Infrastructure component over the network. Exploiting the flaw, they read sensitive CRM data they are not authorized to access, resulting in disclosure of critical business or customer information. No user interaction is required and attack complexity is low, but no public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Information disclosure in Oracle Siebel CRM Deployment (Server Infrastructure) versions 17.0 through 26.9 allows a low-privileged authenticated attacker with HTTP network access to read critical data accessible to the Siebel CRM Deployment component. The vendor CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so impact is limited to confidentiality with no integrity or availability effect; no public exploit was identified at time of analysis and no CISA KEV entry is present. Although the source tags call this an authentication bypass, the assessed vector requires a valid low-privileged Siebel account, making network exposure and account privilege the primary risk factors.
RemediationAI
Apply the Oracle Critical Patch Update fixes referenced in the October 2026 Oracle security advisory at https://www.oracle.com/security-alerts/cpuoct2026.html; patch availability is confirmed by the vendor advisory, but no exact fixed build number is provided in the available data. Until patching is complete, restrict network access to the Siebel CRM Deployment Server Infrastructure HTTP endpoints to trusted administrative networks or VPN segments, which reduces exposure but may complicate legitimate remote deployment workflows. Enforce least privilege on Siebel accounts and review which low-privileged users can reach deployment-server interfaces, noting that this does not eliminate the flaw but lowers the likelihood of exploitation. Monitor HTTP access logs for unusual data-retrieval patterns from low-privileged accounts, accepting that detection may be incomplete without vendor-specific telemetry.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in the Server Infrastructure part of Oracle Siebel CRM Deployment, which exposes HTTP-based deployment and administrative interfaces used to manage Siebel CRM environments. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates a network-reachable, low-complexity issue that requires an authenticated low-privileged account and no user interaction; successful exploitation yields high confidentiality impact but no integrity or availability impact. No CWE is provided, and the 'Authentication Bypass' tag should be treated cautiously because the authoritative vector requires PR:L rather than PR:N. The likely root cause is insufficient authorization or access-control enforcement on a deployment-server endpoint, allowing an authenticated low-privileged user to access data beyond their intended scope.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network HTTP vector with low complexity and no user interaction; PR:L because a valid low-privileged account is required per Oracle, and impact is confidentiality-only (C:H, I:N, A:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB