Oracle Siebel CRM EUVD-2026-37242

Attacker must already have an authenticated low-privilege logon (PR:L) on the infrastructure host where Siebel CRM Cloud Applications and the Siebel Cloud Manager component execute - i.e., shell or equivalent application-tier access on the Siebel server itself, not network access from outside. The Siebel deployment must be running an affected build in the 17.0-26.5 range with Siebel Cloud Manager present and reachable to that local user. Limiting factors: the AV:L vector rules out remote internet exploitation, no user interaction is required (UI:N) so no social engineering is needed once on-host, and there is no indication that a non-default configuration is required. Practical exposure therefore depends on how broadly low-privilege OS or application accounts are granted on Siebel hosts.

The CVSS 3.1 base score of 8.8 is driven largely by the scope change and triple-high CIA impact rather than by remote reachability: the AV:L vector confirms the attacker must already be logged on to the Siebel CRM Cloud Applications infrastructure, and PR:L means they need an existing low-privilege account on that host. Combined with AC:L and UI:N, exploitation is trivial once that foothold exists, but the foothold requirement materially reduces opportunistic mass-exploitation risk. There is no EPSS score, no CISA KEV listing, and no public PoC referenced in the available intelligence, so this is best treated as a high-impact insider/post-compromise escalation rather than an internet-exposed zero-day. Note a likely discrepancy in the vendor tags: the tag set includes 'Information Disclosure' while the description and vector describe full takeover with C:H/I:H/A:H - defenders should treat this as a takeover/RCE-class issue, not a pure disclosure bug.

A help-desk, batch-processing, or third-party integration account with only low Siebel/OS privileges on a Siebel application server abuses the Siebel Cloud Manager component to escalate, taking over the Siebel CRM Cloud Applications instance and pivoting across the scope-changed trust boundary into adjacent Oracle-managed products. Because AC:L and UI:N apply, no user interaction or special timing is needed once the attacker is on the host. No public exploit identified at time of analysis, so realistic threat actors are insiders, compromised service accounts, or adversaries who have already gained initial access through another vector.