EUVD-2026-46500
GHSA-5p45-8hjx-2v86
Severity by source
AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
Network HTTP vector, high complexity and victim interaction required, authenticated low-privilege attacker, confidentiality-only partial data read impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Application Interface). Supported versions that are affected are 17.0-26.4. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 2.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N).
AnalysisAI
Unauthorized partial data read in Oracle Siebel CRM Deployment (Application Interface component) is achievable by low-privileged, network-adjacent authenticated attackers over HTTP across versions 17.0 through 26.4. Exploitation is difficult due to high attack complexity and a mandatory human-interaction requirement, limiting exposure to targeted scenarios rather than opportunistic mass exploitation. No public exploit code or active exploitation has been identified at time of analysis; the low CVSS score of 2.6 reflects the constrained, confidentiality-only impact.
Technical ContextAI
The affected component is the Application Interface layer of Oracle Siebel CRM Deployment, identifiable via CPE cpe:2.3:a:oracle_corporation:siebel_crm_deployment:*:*:*:*:*:*:*:* spanning versions 17.0 to 26.4. The attack surface is HTTP-based, indicating the vulnerability resides in how the web-facing Application Interface handles authenticated requests. Although Oracle did not map a CWE, the 'Authentication Bypass' tag suggests the flaw may allow a low-privileged user to circumvent authorization controls - likely an improper access control or broken object-level authorization issue - enabling read access to data subsets outside their permission boundary. The high attack complexity (AC:H) implies a non-trivial exploitation path, possibly requiring specific timing, session state, or precise request sequencing.
RemediationAI
Apply Oracle's Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses CVE-2026-47011 for all affected Siebel CRM Deployment versions 17.0 through 26.4. An exact fixed release version was not independently confirmed in the available source data beyond the CPU reference - consult the Oracle CPU document directly to identify the precise patch bundle applicable to your installed version. If immediate patching is not feasible, consider restricting network access to the Siebel Application Interface endpoint to trusted IP ranges or VPN-only access to reduce exposure surface, noting this does not eliminate the vulnerability but raises the bar for exploitation given AC:H already constrains the attack path. Also enforce least-privilege account policies to limit the number of low-privileged accounts that could serve as the required attacker foothold.
More in Siebel Crm Deployment
View allLocal privilege escalation in Oracle Siebel CRM Deployment (versions 17.0 through 26.6) allows a low-privileged local at
Local privilege escalation in Oracle Siebel CRM Deployment (Database Upgrade component) versions 17.0 through 26.5 allow
Same weakness CWE-203 – Observable Discrepancy
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today