Oracle Siebel CRM EUVD-2026-106688

Exploitation requires the attacker to already possess a low-privileged authenticated account on the target Siebel CRM Deployment (CVSS PR:L) and network HTTP reachability to the Server Infrastructure component; no user interaction is needed and attack complexity is low. The affected versions are Siebel CRM 17.0 through 26.9. The primary limiting factor is the authentication prerequisite - this is NOT an unauthenticated or authentication-bypass flaw despite the input tag - so exposure is bounded by how many accounts exist and whether the Siebel HTTP interface is reachable from attacker-controlled networks. Impact is limited to confidentiality (full read of accessible data) plus partial integrity (some insert/update/delete); availability is unaffected (A:N).

This is a credible mid-to-upper-tier priority, but not a drop-everything emergency on current signals. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, base 7.1) indicates a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, with high confidentiality impact and limited integrity impact - consistent with Oracle's description of a 'low privileged attacker with network access via HTTP' gaining unauthorized access to critical data plus some write access. However, several key enrichment signals are MISSING: no EPSS exploitation-probability score is provided, the CVE is NOT in CISA KEV, no POC availability is indicated, no SSVC decision data is supplied, and CWE is listed as N/A. Exploitation status is therefore 'no public exploit identified at time of analysis.' Note a signal conflict: the input Tag labels this 'Authentication Bypass,' yet the CVSS vector is PR:L (attacker must already hold low-level authenticated privileges) - an authentication bypass would normally be PR:N, so the tag appears mislabeled and should not be used to justify unauthenticated-attack assumptions. Net: real-world risk is moderate - an authenticated, network-based data-disclosure flaw in a widely used enterprise CRM - but the absence of EPSS/KEV/POC data means there is no evidence of active or imminent mass exploitation, so prioritize via normal Oracle CPU patching rather than emergency response.

An attacker who already holds a low-privileged authenticated Siebel CRM account (or has compromised one) sends crafted HTTP requests to the Server Infrastructure component of an internet- or network-reachable Siebel CRM Deployment. Because attack complexity is low and no user interaction is needed, they read critical Siebel data and perform limited unauthorized inserts/updates/deletes. No public exploit code is identified at time of analysis, so exploitation currently requires original research against the vendor patch.