What is the CVSS score of EUVD-2026-46505?

EUVD-2026-46505 has a CVSS 3.1 base score of 1.9 (Low). CVSS vector: CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Siebel CRM Integration EUVD-2026-46505

| CVE-2026-47016 LOW

Information Exposure (CWE-200)

2026-07-21 oracle

GHSA-cv43-7wpg-x5hg

Information Disclosure Oracle Siebel Crm Integration Oracle Corporation

1.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

1.9 LOW

AV:P/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N

vuln.today AI

1.9 LOW

Physical-only vector (AV:P), high complexity and high privileges confirmed by description; scope change and low confidentiality match the partial cross-component data read with no integrity or availability impact.

3.1 AV:P/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N

4.0 AV:P/AC:H/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Physical

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:40 vuln.today

DescriptionCVE.org

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Event Publish and Subscribe). Supported versions that are affected are 17.0-26.4. Difficult to exploit vulnerability allows physical access to compromise Siebel CRM Integration. While the vulnerability is in Siebel CRM Integration, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel CRM Integration accessible data. CVSS 3.1 Base Score 1.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N).

AnalysisAI

Physical-access data disclosure in Oracle Siebel CRM Integration's Event Publish and Subscribe component exposes a subset of CRM data under conditions requiring physical proximity, high privileges, and difficult exploit circumstances (CVSS 1.9). Versions 17.0 through 26.4 are affected, and a scope change in the CVSS vector signals that a successful attack may also read data from additional products beyond the Integration component itself. No public exploit code exists and this CVE does not appear in the CISA KEV catalog; real-world risk is negligible outside of insider-threat or physical-intrusion scenarios.

Technical ContextAI

The affected component is the Event Publish and Subscribe subsystem within Oracle Siebel CRM Integration, identified by CPE cpe:2.3:a:oracle_corporation:siebel_crm_integration:*:*:*:*:*:*:*:* across versions 17.0 through 26.4. No CWE is assigned, but the 'Authentication Bypass' tag suggests the root cause may involve an internal authorization control failure within the event messaging layer - despite PR:H in the CVSS vector indicating that initial access already requires high privileges, the bypass likely circumvents a secondary or component-level authentication check on event data. The CVSS scope-change flag (S:C) indicates the confidentiality read impact can propagate to at least one additional product or system component that shares context with Siebel CRM Integration, consistent with a pub/sub architecture where event data crosses component trust boundaries.

RemediationAI

Apply the patch delivered in the Oracle Critical Patch Update for July 2026 as documented at https://www.oracle.com/security-alerts/cpujul2026.html; an exact fixed version number was not independently confirmed in the available data, so administrators should consult the CPU advisory directly to identify the target release for their 17.0-26.4 installation. Because exploitation requires physical access, organizations that cannot immediately patch should focus compensating controls on physical security: restrict physical access to Siebel CRM Integration server hardware through locked facilities and physical access logs, enforce least-privilege on Siebel administrative accounts to reduce the pool of credentials meeting the PR:H threshold, and audit Event Publish and Subscribe configurations for unnecessary cross-component data exposure to limit the scope-change impact surface. These controls do not eliminate the vulnerability but effectively neutralize the attack path without patch-related downtime risk.