Siebel CRM Integration EUVD-2026-46505

Physical access to the system running Siebel CRM Integration is a hard prerequisite - remote exploitation is impossible by the AV:P vector. The attacker must also already possess high-privilege credentials (PR:H), meaning this is not an unauthenticated attack; an insider or a threat actor who has separately compromised a privileged account is required. Additionally, attack complexity is rated High (AC:H), meaning specific conditions beyond the attacker's direct control must be met - these are unspecified in the description but may relate to a particular event processing state or timing within the Event Publish and Subscribe component. What limits exploitation most severely is the combination of all three barriers simultaneously: physical presence plus high privileges plus difficult race or configuration conditions. The vulnerability is further constrained to the Event Publish and Subscribe component, so deployments that do not use or expose that subsystem reduce their exposure further.

The CVSS 3.1 base score of 1.9 is among the lowest possible, and the vector (AV:P/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N) compounds multiple severe exploitation barriers: the attacker must be physically present at the device, must already hold high-privilege credentials, and must navigate high attack complexity - three independent prerequisites that must all be satisfied simultaneously. The confidentiality impact is limited to a subset of data (C:L) with no integrity or availability consequence. No EPSS data was provided; however, the stacked physical and privilege requirements make opportunistic or remote automated exploitation impossible by definition. The CVE does not appear in the CISA KEV catalog and no proof-of-concept is publicly known. The only realistic threat actor is a malicious insider or physical intruder who already holds elevated access - a scenario that is better addressed by physical security controls and privileged-access management than by patching cadence alone. The scope change is the sole notable signal elevating concern marginally above negligible.

A malicious insider or physical intruder with existing high-privilege Siebel CRM credentials gains physical access to a server running Siebel CRM Integration 17.0-26.4, then exploits a difficult-to-trigger authentication bypass condition in the Event Publish and Subscribe component to read a subset of CRM integration data they would not otherwise be authorized to access. The scope change means this read access may extend to data in a secondary component sharing the event bus, amplifying the disclosure slightly beyond the Integration component boundary. No public exploit code exists, making ad hoc reproduction unlikely without specialized knowledge.