Siebel CRM Deployment EUVD-2026-106684

Exploitation requires the attacker to already have a high-privileged account with interactive logon access to the infrastructure host where Siebel CRM Deployment (Server Infrastructure component) executes - there is no network-remote path (AV:L) and no unauthenticated access (PR:H). No user interaction is needed (UI:N). Limiting factors: the attacker must first obtain local, high-level privileges on the server, which strongly bounds the realistic attacker population to insiders or those who have already achieved a foothold; affected deployments are Siebel CRM Deployment versions 17.0 through 26.9.

This is a medium-severity issue (CVSS 3.1 base 6.7) whose real-world risk is substantially constrained by its access prerequisites rather than its impact. The vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H shows that although the confidentiality, integrity, and availability impacts are all HIGH (full compromise/takeover of Siebel CRM Deployment), exploitation requires both local access (AV:L - logon to the infrastructure where Siebel CRM Deployment executes) and already-high privileges (PR:H). No EPSS score, KEV listing, POC, or SSVC decision data was provided in the input, so exploitation probability cannot be quantified from these signals. There is no public exploit identified at time of analysis and this is not in CISA KEV. The signals are internally consistent: a low-CVSS-weighting vector (local, high-privilege) paired with high impact yields a medium score, correctly reflecting that this is a privilege-dependent, locally-exploitable flaw rather than a remotely-exploitable priority. An already-high-privileged local user escalating to full takeover of the deployment is the realistic threat - relevant for defense-in-depth and insider/post-compromise scenarios, but not a drop-everything internet-facing emergency. NOTE: the input Tags label this 'Information Disclosure,' which conflicts with the CVSS vector showing full C/I/A impact and a described 'takeover' - the impact is broader than disclosure alone; treat the tag as under-stating impact.

An attacker who already holds high-privileged credentials and can log on to the host running Siebel CRM Deployment abuses the Server Infrastructure component to fully compromise and take over the deployment, gaining control over its confidentiality, integrity, and availability. This is a local, authenticated escalation-to-takeover rather than a remote attack. No public exploit code was identified at time of analysis.