Oracle Siebel CRM EUVD-2026-106623

Exploitation requires the attacker to hold a valid low-privilege account on Siebel CRM Cloud Applications (PR:L) and network HTTP access to the Siebel Cloud Manager component; no user interaction is needed (UI:N). The high attack complexity (AC:H) is a significant limiting factor - Oracle explicitly describes it as 'difficult to exploit,' implying dependence on specific conditions such as a race window, particular application state, or a non-trivial request sequence rather than a single deterministic request. Affected deployments are Siebel CRM Cloud Applications versions 22.3 through 26.9; impact is confined to integrity (unauthorized create/delete/modify of critical data) with no data disclosure or denial of service.

This is a moderate-severity, moderate-priority issue rather than an urgent one. Oracle's own CVSS 3.1 base score is 5.3 with vector AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N - network-reachable over HTTP, but with high attack complexity (AC:H) and requiring low-level authenticated privileges (PR:L). Impact is integrity-only (I:H), with no confidentiality (C:N) or availability (A:N) effect, meaning an attacker could create, modify, or delete critical Siebel data but not read it or cause outages. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of AC:H plus required authentication substantially lowers real-world risk despite the network vector. One notable conflict: the input carries an 'Authentication Bypass' tag, but both the description ('low privileged attacker') and the CVSS vector (PR:L) indicate authentication is REQUIRED, not bypassed - these are contradictory and the tag appears mislabeled; verify the true vulnerability class against the Oracle advisory. No CWE is assigned, limiting root-cause clarity.

A low-privileged authenticated user of Siebel CRM Cloud Applications sends crafted HTTP requests to the Siebel Cloud Manager component to perform unauthorized create, modify, or delete operations on critical application data belonging to other tenants or records. Because the CVSS specifies high attack complexity (AC:H), success likely depends on winning a race condition, meeting specific state preconditions, or chaining non-trivial steps. No public exploit code is identified at time of analysis.