Siebel CRM Deployment EUVD-2026-105876

Exploitation requires network access to the Siebel CRM Deployment's Server Infrastructure component over its TLS-exposed interface, on any supported version from 17.0 through 26.9. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, elevated privileges, user interaction, or special non-default configuration is stated as required - the limiting factor is network reachability to the Server Infrastructure service, so deployments where this component is not exposed to untrusted networks face substantially reduced real-world risk. Impact is confined to confidentiality (reading critical/all Siebel-accessible data); no data modification or service disruption is possible through this flaw.

This is a CVSS 3.1 7.5 (High) information-disclosure flaw in Oracle Siebel CRM's Server Infrastructure component. The CVSS vector (AV:N/AC:L/PR:N/UI:N) is the worst-case profile for reachability: network-exploitable over TLS, low attack complexity, no privileges, and no user interaction, meaning an unauthenticated remote attacker can trigger it directly against an exposed instance. Impact is confidentiality-only (C:H/I:N/A:N), so it enables reading critical or all Siebel-accessible data but not modification or denial of service - this is why the score caps at 7.5 rather than reaching critical. Signals are limited: no EPSS probability, CISA KEV status, or POC availability was provided, so exploitation likelihood cannot be quantified from the input and there is no public exploit identified at time of analysis. The 'Authentication Bypass' tag conflicts somewhat with the description, which characterizes the issue as unauthorized data access by an already-unauthenticated attacker rather than a bypass of an authentication control - treat the tag as unverified. Overall this is a genuine priority for internet-facing or widely-reachable Siebel deployments because of the unauthenticated network vector, but the absence of integrity/availability impact and of any exploitation telemetry (EPSS/KEV/POC) means it is important-to-patch rather than emergency-grade; verify exposure of the Server Infrastructure component to untrusted networks when prioritizing.

An unauthenticated attacker with network reachability to a Siebel CRM Deployment sends crafted traffic over the TLS-exposed Server Infrastructure interface and, due to low attack complexity, obtains unauthorized access to critical or all Siebel-accessible data without needing credentials or user interaction. No public exploit code was identified in the provided data, so this scenario reflects the CVSS-described capability rather than a confirmed in-the-wild technique.