EUVD-2026-106685
GHSA-cwhf-v68j-g95x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged Siebel account
-
ExploitSend crafted HTTP request to Server Infrastructure
-
ExecutionTrigger hang or repeatable crash
-
ImpactComplete denial of service of Siebel CRM Deployment
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to possess valid low-privileged credentials for the Siebel CRM Deployment (PR:L) and network reachability to the Server Infrastructure component over HTTP (AV:N); no user interaction or elevated/admin privileges are needed, and attack complexity is low. The primary limiting factor is the authentication requirement - an anonymous, fully unauthenticated attacker cannot exploit this, so risk is bounded to authenticated users (including compromised accounts or malicious insiders). Impact is confined to availability (service hang/crash, complete DOS of the deployment); there is no data disclosure or modification. All supported versions 17.0 through 26.9 are affected, so no non-default configuration is required. |
| Impact | This is a moderate-severity availability-only flaw (CVSS 3.1 base 6.5) in Oracle Siebel CRM Deployment, affecting all supported versions 17.0-26.9. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates network-exploitable over HTTP with low attack complexity, requiring low-level authenticated privileges and no user interaction, yielding complete denial of service with zero confidentiality or integrity impact. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are internally consistent - the description's 'low privileged attacker with network access via HTTP' aligns cleanly with PR:L and AV:N, and the 'hang or frequently repeatable crash (complete DOS)' maps to A:H with C:N/I:N. The realistic priority is moderate: the PR:L requirement means an attacker needs valid (even minimally privileged) credentials, which bounds this to authenticated insiders or attackers who have already obtained a foothold or valid account, reducing mass-exploitation likelihood. Patch availability via the Oracle October 2026 Critical Patch Update is implied by the reference but the exact fixed version is not stated in the input. Prioritize patching for internet-exposed or multi-tenant Siebel deployments; standalone internal instances carry lower urgency given availability-only impact. |
| Exploit ScenarioDerived | An attacker holding a low-privileged Siebel CRM user account sends a crafted HTTP request to the Server Infrastructure component, triggering a hang or repeatable crash that takes the Siebel CRM Deployment offline (complete DOS). No user interaction is needed and attack complexity is low, so the request can be scripted and replayed to sustain the outage. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Authenticated low-privileged HTTP requests to Oracle Siebel CRM Deployment's Server Infrastructure component can hang or repeatedly crash the service, producing a complete denial of service across all supported releases 17.0 through 26.9 (CVSS 3.1 base 6.5). The attack is network-reachable and low-complexity with no user interaction, but it requires valid low-privileged credentials (PR:L), so risk is bounded to authenticated users, compromised accounts, and malicious insiders rather than anonymous internet attackers. Impact is availability-only - no data disclosure or modification - and no public exploit code or confirmed active exploitation was identified at time of analysis.
RemediationAI
Apply the Oracle Critical Patch Update for October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html); the input data does not specify individual patch or build numbers, so use the advisory's patch availability matrix to select the update for your exact Siebel CRM Deployment release train (17.x through 26.9) and test in a non-production environment first, since deployment-tier updates typically require application downtime and coordinated restarts. Because exploitation requires only low-privileged credentials, treat credential hygiene as a primary compensating control: enforce strong authentication and MFA on Siebel accounts, review and prune low-privilege accounts and stale service users, and alert on unusual volumes or malformed patterns of HTTP requests from authenticated sessions. Restrict network access to the Server Infrastructure HTTP endpoints to trusted administrative and application networks via firewall rules or a reverse proxy, and apply rate limiting and request-size/timeout limits at that proxy - with the trade-off that tight limits can throttle legitimate bulk deployment operations and complicate troubleshooting. Add health monitoring with automatic alerting on service hangs or restart loops so repeatable crash attempts are detected quickly, and stage the vendor patch promptly; these controls reduce exposure but do not remove the underlying defect.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in the Server Infrastructure component of Oracle Siebel CRM Deployment, the tier responsible for deploying and serving the Siebel application stack over HTTP. Oracle's advisory assigns no CWE class, so the precise root cause (for example, unbounded resource consumption, unsafe request handling, or a state-management defect) is not publicly detailed; the CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H characterizes it as a remotely reachable, low-complexity, low-privilege, no-interaction condition whose only scored impact is high availability loss, with unchanged scope. Because exploitation only needs an authenticated session and reachability to the deployment's HTTP interface, the most plausible mechanism is a crafted request sequence that exhausts or corrupts a server-side resource, hanging the service or triggering a repeatable crash. The EUVD record enumerates affected builds as 17.0 up to and including 26.9, and no non-default configuration is required, so exposure follows wherever the deployment HTTP endpoint is reachable; no CPE identifiers were supplied in the source data.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
HTTP-reachable over network (AV:N), low complexity (AC:L), requires a valid low-privileged account per the description (PR:L); availability-only DoS gives A:H with C:N/I:N.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel CRM Deployment. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB