Siebel CRM Deployment EUVD-2026-105878

Exploitation requires the attacker to already possess a valid low-privileged account with interactive local logon to the host/infrastructure where Siebel CRM Deployment's Server Infrastructure component runs (AV:L, PR:L). There is no remote network vector and no user interaction is needed (UI:N). The impact is limited strictly to confidentiality (C:H, I:N, A:N) - the flaw permits unauthorized reading of critical or all Siebel-accessible data but cannot modify data or affect availability. These prerequisites (prior local access plus existing credentials) substantially limit the realistic attacker population to insiders or an adversary who has already gained a foothold on the Siebel server.

This is a moderate-severity, confidentiality-only issue (CVSS 3.1 base 5.5) whose real-world risk is meaningfully constrained by its exploitation requirements. The vendor-supplied CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) establishes that an attacker needs local logon access to the infrastructure where Siebel CRM Deployment executes AND already-held low privileges - this is not a remotely reachable, unauthenticated flaw. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input, so there is no signal of active or probable exploitation; exploitation status is therefore 'no public exploit identified at time of analysis.' The signals are internally consistent (local vector, low complexity, low privileges, high confidentiality impact only) rather than conflicting, so this reads as a genuine but lower-priority insider/post-foothold information-disclosure risk, not a high-urgency internet-facing threat. One notable conflict exists between the provided metadata and the technical facts: the 'Authentication Bypass' tag contradicts the CVSS PR:L (authentication required) and the description's 'low privileged attacker with logon,' so that tag appears mislabeled and should not drive prioritization.

An attacker who already has a low-privileged account and local logon to the server hosting Siebel CRM Deployment leverages the Server Infrastructure flaw to read critical data they should not be able to access, potentially obtaining all Siebel CRM Deployment-accessible data. The low attack complexity means no special timing or race conditions are needed once local access is obtained. No public exploit code was identified in the provided data, so this remains a theoretical post-access scenario rather than a demonstrated one.