Oracle Siebel CRM EUVD-2026-105908

Exploitation targets the Open Integration component of Oracle Siebel CRM Integration (versions 25.12 through 26.9) over HTTP and requires NO authentication (PR:N). However, success is materially limited: it is high-complexity (AC:H, Oracle states 'Difficult to exploit') and mandatorily requires human interaction from a person other than the attacker (UI:R) - i.e., a legitimate user or operator must be induced to perform an action. The scope-change condition (S:C) means a successful attack may reach additional products beyond Siebel CRM Integration. These interaction and complexity requirements are the key factors that keep real-world risk well below the raw network-unauthenticated profile.

This is a genuinely low-priority issue despite being network-reachable and unauthenticated. The CVSS 3.1 base score of 4.7 (Medium) is held down by three strong mitigating factors in the vendor-supplied vector: AC:H (difficult to exploit, confirmed by Oracle's own 'Difficult to exploit' language), UI:R (requires human interaction from a person other than the attacker), and limited impact (C:L/I:L, A:N). The only aggravating factors are AV:N, PR:N (unauthenticated), and S:C (scope change - 'attacks may significantly impact additional products'). No EPSS score was provided in the input, there is no CISA KEV listing, and no public exploit code was identified, so all exploitation-likelihood signals are either absent or negative. The signals are internally consistent: a hard-to-exploit, interaction-dependent, partial-impact flaw in enterprise CRM middleware is unlikely to see opportunistic mass exploitation. Note one conflict to resolve before triage: the input Tags label this 'Authentication Bypass', but the Oracle description does not describe any authentication-bypass behavior - it describes unauthorized partial read and update/insert/delete data access via a scope-change condition requiring user interaction; verify the tag against the authoritative Oracle CPU advisory.

An unauthenticated attacker crafts a malicious HTTP request or link targeting the Open Integration component of Siebel CRM Integration and induces a legitimate user or operator (someone other than the attacker) to trigger it. Because the flaw is hard to exploit (AC:H) and depends on that human interaction, success is conditional, but a triggered attack can yield unauthorized read of a data subset plus unauthorized insert/update/delete on some Siebel data and, via the scope change, impact adjacent products. No public exploit code was identified at time of analysis.