Oracle Siebel CRM EUVD-2026-106678

Exploitation requires the Oracle Siebel CRM End User application using the Open UI component (versions 17.0 through 26.9) to be reachable over HTTP by the attacker, AND requires human interaction from a legitimate Siebel user other than the attacker (UI:R) - typically being induced to follow a crafted link or load attacker-controlled content. No attacker authentication is needed (PR:N). The principal limiting factors are this mandatory victim interaction and the restriction that impact is confined to unauthorized modification of only 'some' data accessible to the interacting user, with no read access or service disruption.

This is a genuinely low-priority issue despite being network-exploitable and unauthenticated. The CVSS 3.1 base score of 4.3 (MEDIUM) reflects the key limiters in the vector: the only impact is low integrity (I:L) with no confidentiality (C:N) or availability (A:N) effect, and successful attack requires user interaction from a victim other than the attacker (UI:R). While AV:N/AC:L/PR:N lower the barrier to reaching the vulnerable component, the UI:R requirement means an attacker cannot act fully autonomously - a legitimate Siebel CRM user must be induced to trigger the flaw, consistent with a reflected/CSRF-style integrity issue in the Open UI component. No EPSS score, CISA KEV listing, SSVC decision data, or public POC was provided in the input, so there are no signals elevating this above its base score. Net assessment: a real but low-severity integrity flaw, not an emergency; patch via the standard Oracle quarterly cycle rather than out-of-band. Note a tagging conflict: the input Tags include 'Authentication Bypass,' but the description and CVSS vector describe a user-interaction-dependent integrity issue, not an authentication bypass - the tag appears mislabeled.

An attacker crafts a malicious link or web request targeting the Siebel CRM Open UI and lures an authenticated Siebel user (the required human interaction) into clicking it, for example via phishing. When the victim's browser processes the request, it performs an unauthorized update, insert, or delete against a subset of Siebel CRM data accessible to that user. No public exploit code was identified at time of analysis.