Oracle Siebel CRM EUVD-2026-37376

No special conditions - remote unauthenticated exploitation against default configurations of Oracle Siebel Apps - Marketing versions 17.0 through 26.5, requiring only HTTP/HTTPS network reachability to the Marketing component. Limiting factors: the attacker must reach the Marketing HTTP service (Siebel is typically deployed inside corporate networks behind VPN/reverse proxies rather than on the public internet), and the deployment must run a supported Siebel version in the 17.0-26.5 band with the Marketing component licensed and enabled. No user interaction, no credentials, and no non-default configuration are required per the CVSS vector AV:N/AC:L/PR:N/UI:N.

All available signals point to high real-world risk: CVSS 9.8 with network attack vector, low complexity, no privileges, and no user interaction; full CIA impact; and a long version band (17.0 to 26.5) suggesting most production deployments are vulnerable. Counterbalancing signals are that no EPSS score, KEV listing, or public POC is provided in the input, and Siebel CRM is typically deployed behind enterprise perimeters rather than directly internet-exposed, which may limit opportunistic mass exploitation. Tags label this as 'Information Disclosure', which conflicts with the full I:H/A:H impact and 'takeover' wording in the description - defenders should treat the description and CVSS as authoritative over the tag.

An attacker who can reach the Siebel Marketing HTTP listener - directly over the internet or after pivoting onto an internal segment - sends a single crafted unauthenticated HTTP request to a vulnerable endpoint and obtains full control of the Marketing application, including campaign data, customer PII used for targeting, and the ability to send outbound communications under the victim's brand. No public exploit identified at time of analysis, but the low complexity and lack of preconditions mean reliable exploitation is likely once details surface.