Oracle Siebel CRM EUVD-2026-105881

Exploitation requires the attacker to already have an authenticated low-privileged logon to the host/infrastructure where Siebel CRM Deployment's Server Infrastructure component executes - it is not remotely reachable (AV:L). Affected supported versions are 17.0 through 26.9. Limiting factors that reduce real-world risk: high attack complexity (AC:H) implies non-trivial, possibly race- or configuration-dependent conditions that are not fully reliable; local-only access (no network vector); and a pre-existing valid account (PR:L). No user interaction is needed (UI:N). The exact feature or configuration triggering the flaw is not detailed in the available Oracle CPU data.

This is a genuine but moderate-priority issue rather than a top-tier emergency. The CVSS 3.1 base score is 6.3 (Medium), and the vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N tells a consistent, risk-limiting story: exploitation requires local logon access to the infrastructure where Siebel CRM Deployment runs (AV:L), already-held low privileges (PR:L), and the attack is of high complexity (AC:H), all of which substantially raise the bar versus a remote unauthenticated flaw. The upside for an attacker is real - High confidentiality and High integrity impact (C:H/I:H) with no availability impact (A:N) - meaning read and modify/delete access to critical Siebel data. No EPSS score, CISA KEV listing, SSVC decision data, or public POC was provided, so exploitation-probability signals are absent; per the precision rules this is treated as 'no public exploit identified at time of analysis.' A notable conflict exists in the input metadata: the tag 'Authentication Bypass' contradicts both the description ('low privileged attacker with logon') and the vector (PR:L requires authentication), so the authentication-bypass framing should be disregarded as mislabeled. Net: a locally-authenticated, high-complexity privilege/data-compromise bug worth patching in the normal Oracle CPU cycle, not a drop-everything exploit.

A low-privileged user who already has a valid logon to the server/infrastructure hosting Siebel CRM Deployment chains the Server Infrastructure flaw under specific conditions (high attack complexity) to read, modify, or delete critical Siebel CRM data beyond their authorization. No user interaction is required, but the attacker must first obtain local authenticated access. No public exploit code was identified at time of analysis.