Oracle Siebel CRM EUVD-2026-105880

Requires an attacker to already hold a low-privileged logon (PR:L) to the infrastructure/host where the Siebel CRM Deployment Server Infrastructure component executes; the vector is local only (AV:L), so it cannot be triggered remotely over the network and no user interaction is needed (UI:N). Limiting factors: the attacker must first gain authenticated local/interactive access to the Siebel server, affected versions are Siebel CRM Deployment 17.0 through 26.9, and there is no availability impact. These constraints mean practical exploitation is confined to insiders or attackers who have already achieved a foothold on the Siebel host.

This is a genuine but moderate-priority issue rather than a drop-everything emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 7.1) is the strongest available signal: exploitation requires LOCAL access (AV:L) and an existing low-privileged authenticated session (PR:L) on the host where Siebel CRM Deployment runs, which substantially caps real-world reach compared to a network-exploitable flaw. Once those preconditions are met, complexity is low (AC:L) and impact is high for both confidentiality and integrity (C:H/I:H), with no availability impact (A:N). No EPSS score was provided, the CVE is not listed in CISA KEV, and no public proof-of-concept was supplied - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The input 'Authentication Bypass' tag directly conflicts with the CVSS vector: PR:L and the description's phrase 'low privileged attacker with logon' indicate an authenticated-privilege-escalation/data-access flaw, NOT a pre-authentication bypass - this tag appears mislabeled and should be treated with skepticism. Overall: a real local post-authentication risk warranting patching in the normal Oracle CPU cycle, but the local-only vector and authentication requirement make mass or remote exploitation unlikely.

An attacker who already has a low-privileged local or interactive logon on the server hosting Siebel CRM Deployment (for example a limited application or OS account, or a malicious insider) abuses a Server Infrastructure flaw to read and modify data beyond their authorization. Because attack complexity is low and no user interaction is required, the attacker can reliably reach all Siebel CRM Deployment-accessible data to create, delete, or alter critical records. No public exploit code is known at time of analysis, so exploitation would require independent development.