Oracle Siebel CRM EUVD-2026-105870

Requires an authenticated, low-privileged local account with logon access to the infrastructure/host where Siebel CRM Development (Configuration Tools) executes - exploitation is not possible over the network (AV:L) and cannot be performed by an unauthenticated attacker (PR:L). No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once local authenticated access is obtained in affected versions 17.0 through 26.9, exploitation is straightforward. The principal limiting factors are the local-only access requirement and the need for valid low-privilege credentials on the Siebel development host, which confines realistic risk to insiders or attackers who have already established a foothold.

This is a moderate-severity, insider-or-local-access vulnerability rather than a mass-exploitation priority. The CVSS 3.1 base score is 6.1 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N - the local attack vector (AV:L) and the requirement for an authenticated low-privileged account (PR:L) are the dominant risk-limiting factors, since an attacker must already have logon access to the infrastructure where Siebel CRM Development runs. The high integrity impact (I:H) is the main driver of severity, allowing unauthorized creation, deletion, or modification of critical data, with only limited confidentiality exposure (C:L) and no availability impact (A:N). No EPSS probability score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Note a conflict: the input Tags include 'Authentication Bypass,' but the CVSS vector and description both require an authenticated low-privileged session (PR:L, 'low privileged attacker with logon'), which contradicts an authentication-bypass characterization - this tag appears mislabeled and should not be used to elevate urgency. Overall this is a legitimate but non-urgent fix best handled in normal Oracle CPU patch cycles, prioritized for environments where untrusted or numerous low-privileged users can log on to Siebel development/configuration hosts.

An attacker or malicious insider who already holds a low-privileged account on the host where Siebel CRM Development (Configuration Tools) runs abuses the vulnerable component to gain unauthorized write access, altering or deleting critical Siebel configuration and business data. Because the vector is local (AV:L) with low complexity (AC:L) and no user interaction, exploitation is straightforward once that foothold exists, though it cannot be performed remotely. No public exploit code was identified in the provided data.