EUVD-2026-46518
GHSA-49rr-mq22-qwpx
Severity by source
AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:N/A:L
Oracle's published vector is fully consistent with the description: network HTTP access, high privilege requirement, mandatory victim interaction, high complexity, scope change to downstream systems, and only partial availability impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Redwood UI). Supported versions that are affected are 24.4-26.3. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel CRM End User, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Siebel CRM End User. CVSS 3.1 Base Score 2.6 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:N/A:L).
AnalysisAI
Partial availability disruption in Oracle Siebel CRM End User (Redwood UI component, versions 24.4 through 26.3) can be triggered by a highly privileged network attacker over HTTP under difficult exploitation conditions that also require victim interaction, potentially causing cascading availability degradation in interconnected systems due to a confirmed scope change. The CVSS 3.1 base score of 2.6 (Low) reflects the extremely restrictive prerequisite chain - high privileges, user interaction, and high attack complexity must all align. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Technical ContextAI
The affected component is the Redwood UI, Oracle's modern web front-end layer for Siebel CRM, accessible via HTTP. The CPE string (cpe:2.3:a:oracle_corporation:siebel_crm_end_user) covers the end-user-facing application tier, not the backend infrastructure. No CWE was assigned by Oracle, so the exact root cause class (e.g., improper resource management, cross-site interaction, or UI redressing) cannot be confirmed from available data. The CVSS scope change flag (S:C) indicates the flaw in the Redwood UI layer can propagate availability impact beyond the immediate application to other products or services that depend on or integrate with Siebel CRM End User - a meaningful architectural signal despite the low base score.
RemediationAI
Apply the Oracle Critical Patch Update for July 2026, available via the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched version number is not independently confirmed beyond the CPU reference - administrators should consult the full CPU matrix to identify the specific patch bundle for their Siebel CRM release. Given the extremely low severity and the requirement for high-privilege attacker access, organizations that cannot immediately patch should assess whether the Redwood UI endpoint is exposed to the broader network and consider restricting HTTP access to Siebel administrative interfaces to trusted IP ranges only. This reduces the AV:N attack surface without functional impact to intended users on approved networks. No workaround is specified in available references.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today