Siebel Apps Marketing EUVD-2026-105811

Exploitation requires human interaction from a victim other than the attacker (CVSS UI:R) - a logged-in or targeted Siebel Apps - Marketing user must be socially engineered into clicking a crafted link or loading attacker-supplied content served through the Marketing component's HTTP interface. No attacker authentication is needed (PR:N) and the target is network-reachable over HTTP, but the mandatory user-interaction step is the primary limiting factor, meaning successful attacks depend on phishing or similar lures rather than direct automated exploitation. Affected deployments are Siebel Apps - Marketing versions 17.0 through 26.9; environments where the Marketing component is not exposed to untrusted users carry reduced practical risk.

This is a moderate-severity issue (CVSS 3.1 base 6.1) that should be patched on a routine cycle rather than treated as an emergency. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N describes a network-reachable, low-complexity, unauthenticated flaw - but the UI:R requirement means an attacker cannot act alone and must socially engineer a legitimate user into interacting (clicking a link or visiting crafted content). Combined with the scope change (S:C), low confidentiality and integrity impact, and no availability impact, this profile is textbook reflected cross-site scripting (XSS) rather than a direct server compromise. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active or probable near-term exploitation: exploitation status is 'no public exploit identified at time of analysis.' Note the conflict between the input Tags ('Authentication Bypass') and the actual CVSS profile - a UI:R / S:C / C:L/I:L/A:N vector does not describe an authentication bypass and the 'Authentication Bypass' tag appears mislabeled; the description itself never mentions authentication being bypassed. Overall this is a real but non-urgent priority: the user-interaction gate and low impact ceiling keep real-world risk well below the raw score, absent any exploitation evidence.

An unauthenticated attacker crafts a malicious URL or payload targeting the Siebel Apps - Marketing web interface and uses phishing or a planted link to lure an authenticated Siebel user into clicking it. When the victim's browser processes the reflected payload, attacker-controlled script runs in the victim's session context, enabling limited unauthorized reading and modification of Siebel Marketing data and potential impact on linked products due to the scope change. No public exploit code was identified in the provided data.