Oracle Siebel CRM EUVD-2026-105892

Exploitation requires human interaction from a user other than the attacker (UI:R) - a victim with access to Siebel Apps - Marketing must interact with attacker-supplied content (e.g., click a crafted link or load a malicious request), so this cannot be triggered against the server autonomously. No authentication is required of the attacker (PR:N) and no special target configuration is named in the description; the exposure applies to Siebel CRM Marketing versions 17.0 through 26.9 reachable over HTTP. The dependence on victim interaction is the primary limiting factor and prevents automated/mass exploitation, confining realistic attacks to social-engineering against specific Marketing users.

This is a moderate, low-priority issue despite being network-exploitable and unauthenticated. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, base 4.3 MEDIUM) shows the only real limiting factor is the required user interaction (UI:R): an attacker needs a victim to perform an action for the attack to succeed, which caps the score. Impact is narrow - integrity only, and only LOW (I:L): unauthorized update/insert/delete to SOME accessible data, with zero confidentiality (C:N) and zero availability (A:N) impact. No EPSS score was provided, the CVE is not in CISA KEV, and no public exploit code is referenced, so there is no public exploit identified at time of analysis. SSVC-style reading: exploitation is 'none' (no evidence of active use), it is NOT automatable (UI:R breaks mass/automated exploitation), and technical impact is 'partial'. The signals are consistent rather than conflicting - a genuinely medium-severity, low-urgency flaw. Note one metadata conflict to verify: the input Tag labels this 'Authentication Bypass,' but the vector (PR:N already unauthenticated, C:N, I:L, UI:R) is far more consistent with a client-side issue such as reflected/stored XSS or CSRF than with an authentication bypass - treat the tag with skepticism and confirm the vulnerability class with Oracle's advisory.

An attacker crafts a malicious HTTP request or link targeting the Siebel Apps - Marketing component and lures a legitimate user (e.g., a marketing operator) into interacting with it, for example by clicking a crafted URL. When the victim's browser or session processes the request, it performs an unauthorized update, insert, or delete against some Siebel Marketing data. No public exploit code is identified at time of analysis, and the required human interaction (UI:R) makes this a targeted social-engineering attack rather than a mass-exploitable one.