Oracle Siebel CRM EUVD-2026-105872

Exploitation requires the attacker to already have a HIGH-privileged logon (PR:H) to the infrastructure/host where Siebel CRM Development executes and to interact locally (AV:L) with the Configuration Tools component; there is no network vector and no user interaction. Limiting factors: the local-access and high-privilege prerequisites mean only already-trusted privileged accounts (administrators, privileged operators, or a host already compromised to that level) can exploit it, confining impact to a segregation-of-duties / privilege-escalation-of-data-access boundary rather than external attack. Affected: Siebel CRM Development versions 17.0 through 26.9.

This is a moderate-risk, defense-in-depth issue rather than an urgent priority. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N, base 6.0) is internally consistent and self-limiting: exploitation requires LOCAL access (AV:L) AND pre-existing HIGH privileges (PR:H) on the infrastructure where Siebel CRM Development executes, which sharply reduces the attacker population to users who already hold privileged logon. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active or probable exploitation - SSVC-style framing would place this at 'exploitation: none' with limited automatability given the local, high-privilege prerequisite. The high Confidentiality and Integrity impacts (C:H/I:H) are real but materialize only after an attacker is already authenticated and privileged, making this primarily a privilege-boundary/segregation-of-duties concern rather than a remotely weaponizable flaw. One conflicting metadata signal: the input Tag 'Authentication Bypass' contradicts the CVSS vector, which requires PR:H - a genuine authentication bypass would not need high privileges, so treat that tag as suspect and rely on the Oracle-sourced vector instead.

An attacker who already holds a high-privileged logon to the host running Siebel CRM Development (e.g., a privileged operator, administrator, or compromised service account) abuses the Configuration Tools component locally to read or modify critical Siebel data beyond their intended authorization. No remote vector and no user interaction are involved, and no public exploit code was identified at the time of analysis.