Siebel CRM EUVD-2026-105864

Exploitation requires network reachability to the Siebel Management Console component of Siebel CRM Deployment over HTTP; no authentication, elevated privileges, or user interaction is needed (PR:N/UI:N), so exposed consoles on affected versions 17.0 through 26.9 are directly reachable. The practical limiting factor is network exposure: Siebel Management Console is an administrative component typically restricted to internal management networks, so organizations that do not expose it to untrusted networks substantially reduce real-world risk. Impact is further bounded to unauthorized read access to only a subset of accessible data (C:L), with no write/modify or denial-of-service capability.

This is a moderate-severity information-disclosure flaw (CVSS 3.1 base 5.3) in Oracle Siebel CRM's Siebel Management Console. The CVSS vector (AV:N/AC:L/PR:N/UI:N) is favorable to attackers - network-reachable, low complexity, no privileges, no user interaction - which is why a confidentiality-only issue still scores Medium. However, the impact is deliberately limited: only C:L (partial, unauthorized read of a subset of data), with no integrity or availability impact and no scope change. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The realistic priority is therefore 'patch in normal Oracle CPU cadence' rather than emergency: unauthenticated network reachability makes it attractive to opportunistic scanning, but the limited read-only impact and absence of exploitation signals argue against treating it as a widespread threat. Note a conflict in the metadata: the input Tags include 'Authentication Bypass', yet Oracle's description characterizes this as unauthenticated read access to a subset of data, not a bypass of an authentication boundary - verify the tag against the official Oracle advisory before relying on it for triage.

An unauthenticated attacker who can reach the Siebel Management Console over HTTP sends a crafted request to the exposed endpoint and retrieves a subset of Siebel CRM Deployment data they should not be able to read. Because no authentication, privileges, or user interaction are required (AV:N/AC:L/PR:N/UI:N), the attack is feasible against any internet- or network-exposed console. No public exploit code was identified in the provided intelligence.