Oracle Siebel CRM EUVD-2026-105869

Exploitation requires the attacker to already have (1) local logon access to the server/infrastructure host where the Siebel CRM Deployment component (Server Infrastructure) executes, and (2) an existing HIGH-privilege account on that system (PR:H). There is no remote network vector (AV:L) and no user interaction is needed (UI:N). The scope is unchanged (S:U), so impact is confined to the Siebel CRM Deployment component itself. These prerequisites - authenticated high-privilege local access - are the primary limiting factors and significantly reduce the pool of potential attackers to insiders or those who have already compromised a privileged account on the host. Affected supported versions are Siebel CRM 17.0 through 26.9.

This is a moderate-severity issue (CVSS 3.1 base 6.7) whose real-world priority is substantially constrained by its access requirements. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H requires LOCAL access (AV:L) and HIGH privileges (PR:H), meaning the attacker must already have logon access to the infrastructure where Siebel CRM Deployment executes and already hold a high-privilege account - a significant barrier that makes this primarily a privilege-escalation / trust-boundary-abuse issue rather than a remotely exploitable flaw. Although the impact metrics are maximal (C:H/I:H/A:H, full takeover of the Siebel CRM Deployment component), the prerequisites make opportunistic mass exploitation unlikely. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input; with no public exploit identified at time of analysis and no evidence of active exploitation, this reads as a high-CVSS-impact but low-immediate-real-risk item suitable for normal patch-cycle remediation rather than emergency response. One inconsistency to flag: the input Tags label this 'Information Disclosure,' yet the vector and description describe full integrity and availability compromise ('takeover'), so the tag understates the actual impact - treat it as a full-compromise issue, not merely disclosure.

An attacker who has already obtained a high-privilege account with logon access to the server host running Siebel CRM Deployment leverages the Server Infrastructure flaw to fully compromise the Siebel CRM Deployment component, gaining control over its confidentiality, integrity, and availability. Because the CVSS vector is AV:L/AC:L/PR:H, this is a low-complexity local action performed by an already-privileged insider or an attacker who has pivoted onto the host. No public exploit code was identified in the provided data.