Oracle Siebel CRM EUVD-2026-105812

Exploitation requires the attacker to already have a valid low-privileged logon to the infrastructure/host where Siebel Apps - Marketing executes (local attack vector, no remote network path) and to target the Marketing component specifically. Affected supported versions are 17.0 through 26.9. Limiting factors are significant: the attack is rated high-complexity (AC:H), meaning success depends on conditions outside the attacker's direct control, and prior authentication (PR:L) is mandatory - there is no unauthenticated or purely remote exploitation path, and no end-user interaction is required (UI:N). Impact is bounded to data integrity (unauthorized create/delete/modify), with no confidentiality or availability consequence.

This is a genuinely moderate-to-low real-world risk despite being an integrity flaw in enterprise CRM software. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N, base 4.7) is internally consistent with the Oracle description: exploitation requires local logon access to the host where Siebel Apps - Marketing runs (AV:L), is difficult to exploit (AC:H), and requires an already-authenticated low-privileged account (PR:L). No EPSS score, KEV listing, or POC is present in the provided intelligence, and there is no public exploit identified at time of analysis. The combination of local attack vector, high complexity, and required prior authentication substantially limits weaponizability - this is not a remotely-triggerable, mass-exploitable issue. The impact is confined to integrity (unauthorized creation, deletion, or modification of critical Siebel Marketing data) with no confidentiality or availability loss. One data-quality concern: the input carries an 'Authentication Bypass' tag, which directly contradicts the CVSS vector's PR:L (exploitation requires a valid authenticated session, not a bypass of authentication) and the Integrity-only impact - this tag appears mislabeled and should not drive prioritization. Overall: a real but lower-tier issue appropriate for routine patch-cycle remediation rather than emergency response.

A low-privileged user who already holds a valid logon on the infrastructure hosting Siebel Apps - Marketing leverages a flaw in the Marketing component to exceed their authorization and alter or delete marketing campaign or customer data they should not be able to touch. The attack is local and technically difficult (AC:H), requiring specific conditions to be met, and no public exploit code is known to exist.