EUVD-2026-105884
GHSA-h96v-vjwx-7w5w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify internet-facing Siebel Cloud Gateway
-
ExploitSend crafted unauthenticated HTTP request
-
ExecutionTrigger unauthorized data access flaw
-
ImpactExfiltrate critical Siebel CRM data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The affected component is the Siebel Cloud Gateway, the network-facing entry/proxy tier of a Siebel CRM Deployment; exploitation requires only that this Gateway be reachable over HTTP by the attacker. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), there are no special conditions beyond network reachability - unauthenticated, remote exploitation against affected deployments (versions 17.0 through 26.9) with no user interaction and no non-default configuration cited by Oracle. The primary limiting factor is network exposure: deployments whose Cloud Gateway is restricted to internal networks or behind access controls substantially reduce real-world reachability. Impact is bounded to confidentiality (data disclosure); no integrity or availability effect is indicated. |
| Impact | This is a genuine priority for any organization running Oracle Siebel CRM. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes the worst-case exposure profile for pre-authentication attacks: network-reachable over HTTP, low complexity, no privileges, and no user interaction required. The 7.5 score is capped below critical only because impact is limited to confidentiality (C:H/I:N/A:N) - an attacker can read critical data but cannot modify data or disrupt availability through this flaw alone. Countervailing signals temper urgency: there is no CISA KEV listing, no EPSS score was provided, and no public proof-of-concept is referenced, so there is currently no evidence of active or imminent mass exploitation. The flaw resides in the Siebel Cloud Gateway, an internet-facing reverse-proxy/entry component, which raises exposure relative to internal-only modules. Net assessment: high-value, easily-exploitable data-disclosure bug that should be patched in the next Oracle CPU cycle, but not yet an emergency without exploitation evidence. Note the 'Authentication Bypass' tag versus the Oracle description, which frames this as unauthorized data access rather than a session/identity bypass - treat the mechanism as unconfirmed until Oracle's advisory detail is reviewed. |
| Exploit ScenarioDerived | An attacker who can reach the Siebel Cloud Gateway over the network sends a crafted HTTP request directly to the exposed endpoint without any credentials. Because no authentication, privileges, or user interaction are required (PR:N/UI:N) and complexity is low (AC:L), the request returns or exposes sensitive Siebel CRM data such as customer records or business-critical information. No public exploit code has been identified at time of analysis, so this reflects the attack profile implied by the CVSS vector rather than an observed exploit. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Unauthenticated information disclosure in the Oracle Siebel CRM Deployment Cloud Gateway lets any remote attacker who can reach the gateway over HTTP read critical data and, per Oracle, potentially all data accessible through that deployment; supported versions 17.0 through 26.9 are affected. The CVSS 3.1 score is 7.5 with confidentiality-only impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), meaning no user interaction, no privileges, and no integrity or availability effect. Oracle's October 2026 Critical Patch Update advisory is the cited vendor reference and is the source of the fix; no public exploit code has been identified at time of analysis, and the flaw is not listed as confirmed actively exploited (CISA KEV).
RemediationAI
Apply the Oracle Critical Patch Update for October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html) to every Siebel CRM Deployment running Cloud Gateway in the 17.0-26.9 range; this is the vendor-released remediation path and no separate exact fix build number is stated in the available data, so verify the applicable patch level against the advisory before closing the finding. Because exploitation requires only HTTP reachability, treat network placement as the primary compensating control until patching completes: remove the Cloud Gateway from direct internet exposure and place it behind a VPN, allowlisted source ranges, or a reverse proxy/WAF that enforces authentication and filters requests to expected gateway endpoints. The trade-off is that legitimate remote and partner users lose direct access and must onboard to the VPN or proxy path, and WAF/allowlist rules can break integrations if the gateway legitimately serves unauthenticated endpoints - validate with a staging deployment before enforcing. Additionally, enable and review gateway/HTTP access logs for unauthenticated requests returning bulk or sensitive data, which provides detection coverage but not prevention, and confirm no shadow or test instances of the gateway remain reachable outside the controlled perimeter.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The exposure sits in the Cloud Gateway component of Siebel CRM Deployment, which is the network-facing entry/proxy tier that fronts a Siebel CRM deployment and brokers HTTP traffic toward the application. Oracle does not publish a CWE for this issue, but the supplied tagging as an authentication bypass is consistent with the assessed vector: the gateway fails to properly enforce authentication/authorization on a reachable HTTP path, so requests that should require identity are served data instead. Because AV:N/AC:L/PR:N/UI:N applies, exploitation only requires TCP/HTTP reachability of the Gateway from the attacker's position, with no credentials, no victim interaction, and no non-default configuration cited by Oracle; scope is unchanged (S:U) so impact is confined to the vulnerable component's own security authority. The practical constraint is topology rather than technical complexity: deployments that expose the Cloud Gateway to untrusted networks (internet-facing or broadly reachable internal segments) carry the full risk, while gateways restricted to internal networks or fronted by access control are substantially less reachable. Impact is bounded to confidentiality (C:H/I:N/A:N) - disclosure of data the gateway can access, not modification or denial of service.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description confirms unauthenticated network HTTP access (AV:N/PR:N/UI:N/AC:L) with confidentiality-only impact (C:H, I/A:N) and no scope change.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Cloud Gateway). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Executive ViewAI
Oracle Siebel CRM Deployment Cloud Gateway versions 17.0 through 26.9 is affected by a high-severity unauthenticated information-disclosure flaw that can expose critical data-potentially all data accessible through the deployment-to any remote attacker who can reach the gateway over HTTP. Leadership should care because CRM and deployment data may include sensitive customer, operational, or configuration information, and no credentials or user interaction are required to trigger the weakness. No public exploit identified at time of analysis, but internet-facing or broadly reachable gateways should be treated as an immediate exposure until access is constrained and a vendor fix is available.
No vendor-released patch identified at time of analysis. Restrict network access to Oracle Siebel CRM Deployment Cloud Gateway versions 17.0 through 26.9 to trusted networks only; place internet-facing instances behind an authenticated reverse proxy, VPN, or zero-trust access layer; disable or block unnecessary HTTP endpoints; segment gateways from sensitive data stores; enable detailed logging and alerting for anomalous reads or enumeration; review logs for unauthorized access; and monitor Oracle's October 2026 Critical Patch Update advisory for the exact fixed version and remediation guidance.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB