Oracle Siebel CRM EUVD-2026-106698

No special conditions beyond network reachability - remote unauthenticated exploitation over HTTP against the Server Infrastructure component of Oracle Siebel CRM Deployment, affecting supported versions 17.0 through 26.9 (per CVSS PR:N/UI:N/AC:L). The description names no required feature toggle or non-default configuration. Limiting factors: the attacker must have network HTTP access to the Siebel CRM Deployment (mitigated where the server is not internet-exposed or is segmented behind network controls), and impact is confined to unauthorized reading of data - there is no integrity or availability impact, so the flaw cannot by itself be used to alter records or cause outages.

The CVSS 3.1 base score is 7.5 (High) driven by a clean network-exploitable profile: AV:N/AC:L/PR:N/UI:N means an unauthenticated remote attacker can reach the flaw over HTTP with low complexity and no user interaction. However, impact is confidentiality-only (C:H/I:N/A:N) - the attacker can read critical Siebel CRM data but cannot modify data or disrupt availability, so this is an information-disclosure issue, not full compromise. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the real-world urgency therefore rests on the easy, unauthenticated attack profile rather than on observed exploitation. One signal conflicts: the input Tags include 'Authentication Bypass', but the CVSS vector and description describe unauthenticated read access to data (confidentiality impact only), not a privilege/authentication-state bypass - treat the 'Authentication Bypass' characterization with caution and verify against the Oracle advisory. Overall this is a genuine patch priority for Siebel operators given PR:N/AC:L network reach, but it is bounded by being confidentiality-only with no confirmed exploitation.

An unauthenticated attacker with network access to an internet-facing or internally-reachable Siebel CRM Deployment sends crafted HTTP requests to the Server Infrastructure component and retrieves critical business data accessible to that deployment. No credentials, user interaction, or special privileges are required, and attack complexity is low. No public exploit code was identified in the provided data.