Siebel CRM Integration EUVD-2026-106631

Exploitation targets the Open Integration component of Oracle Siebel CRM Integration on supported versions 25.12 through 26.9; the attacker must reach the product's HTTP interface over the network. Per the CVSS vector no authentication (PR:N), no user interaction (UI:N), and no special configuration is stated as required, and impact is limited to confidentiality (unauthorized read access to Siebel CRM Integration data) - there is no integrity or availability impact. The practical limiting factor is network exposure: the Siebel Integration HTTP endpoint must be reachable by the attacker, so instances restricted to internal/segmented networks or behind authenticating proxies materially reduce real-world exposure. The Oracle summary does not state whether a non-default feature must be enabled, so confirm against the advisory whether the affected endpoint is active in default deployments.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes an attractive flaw for attackers: network-reachable over HTTP, low complexity, no privileges, and no user interaction, yielding high confidentiality impact (full read access to Siebel CRM Integration data) with no integrity or availability impact. This is a data-disclosure issue, not a code-execution or takeover issue, which caps its real-world severity below the 'critical' tier despite the easy exploitability. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the 7.5 reflects potential rather than demonstrated in-the-wild use. CONFLICT TO NOTE: the input carries an 'Authentication Bypass' tag, yet the Oracle description frames this as an unauthenticated-attacker confidentiality flaw (PR:N) rather than a documented bypass of an authentication control - verify the precise mechanism against the Oracle advisory, as the tag may overstate the nature of the weakness. Treat this as a genuine patch priority for Siebel CRM operators (easy, unauthenticated data exposure) but not an emergency on the level of an RCE or a KEV-listed flaw.

An unauthenticated attacker with network access sends a crafted HTTP request to the exposed Siebel CRM Integration (Open Integration) endpoint and, without logging in or any user interaction, reads critical Siebel CRM data returned by the service. No public exploit code is identified at time of analysis, but the low attack complexity (AC:L) means a working request would be straightforward to develop once the flawed endpoint is identified.