Oracle Siebel CRM EUVD-2026-105873

This is a genuinely high-priority vulnerability by CVSS signal: the vendor-assigned CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity attack requiring only low privileges and no user interaction, yielding full confidentiality, integrity, and availability impact ('takeover'). The SSVC technical-impact dimension is therefore 'total.' However, several key exploitation signals are MISSING from the provided data: there is no EPSS probability, no CISA KEV listing, and no POC indicator supplied, so exploitation likelihood and automatability cannot be quantified - the risk ranking here rests on CVSS severity alone, not on observed exploitation. The one tag ('Information Disclosure') UNDERSTATES the impact: the CVSS vector shows C:H/I:H/A:H (full takeover), not merely disclosure, so defenders should not treat this as a read-only issue. The qualifier 'via SQL' plus low-privilege access strongly implies a SQL-injection-style flaw reachable by any authenticated Siebel user, which is a realistic insider or compromised-account vector. Net: treat as a real priority for any organization running Siebel Life Sciences, but note that absence of KEV/EPSS/POC means there is no current evidence of active or widespread exploitation - this is a patch-promptly, not drop-everything, item pending exploitation telemetry.