Siebel CRM Deployment EUVD-2026-105865

Exploitation requires physical (local hands-on) access to the system hosting the Siebel Management Console component of Siebel CRM Deployment, versions 17.0 through 26.9 (per CVSS AV:P). No authentication is required once physical access is obtained (PR:N) and no user interaction is needed (UI:N), but the Physical attack vector is the dominant limiting factor: the vulnerability cannot be reached over a network or locally via remote shell, and impact is confined to unauthorized read access to a subset of deployment data (no write/modify or denial-of-service capability).

This is a genuinely low-priority vulnerability, and the signals are consistent in that direction. The Oracle-assigned CVSS 3.1 base score is 2.4 with vector AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - the attack vector is Physical, meaning an attacker must have hands-on access to the device/console hosting the Siebel Management Console, and impact is limited to read-only disclosure of a subset of data (C:L, no integrity or availability impact). No EPSS score, no CISA KEV listing, and no public POC were provided, which aligns with the low CVSS: the Physical attack vector alone makes mass or remote exploitation impractical. There is a notable conflict in the metadata: the input Tag 'Authentication Bypass' is not supported by the description, which describes physical-access read disclosure rather than any bypass of authentication - verify the tag with the source advisory (Oracle CPU Oct 2026). Bottom line: this is a low-real-risk issue whose primary limiting factor is the requirement for physical access; it does not warrant emergency patching but should be included in routine Oracle Critical Patch Update remediation.

An attacker with physical access to a host or terminal running the Siebel Management Console reads a limited subset of Siebel CRM Deployment data directly from the system. No exploit code is publicly identified, and the attack cannot be performed remotely or over a network - it requires local, hands-on access to the affected deployment console.