Siebel CRM EUVD-2026-47061

Exploitation requires local logon access (AV:L) to the infrastructure where Siebel CRM Cloud Applications executes - the attacker must have an OS-level session on the host, not merely network reachability. A low-privileged account on that infrastructure is also required (PR:L); fully unauthenticated external exploitation is not possible based on the CVSS vector. No user interaction is needed once these prerequisites are met. Exploitation is limited by the need for prior local infrastructure access, which restricts the realistic attacker population to insiders, privileged contractors, compromised service accounts, or attackers who have already achieved initial compromise of the host via a separate vector. Non-default configuration is not a stated prerequisite - any supported Siebel CRM Cloud Applications deployment in the 22.3-26.5 version range appears affected. The scope change condition means the exploitation impact is not contained to the initial process or data store.

The CVSS 3.1 score of 6.5 is driven by the local attack vector (AV:L), which substantially limits exposure compared to network-exploitable flaws. Exploitation requires an attacker to already possess low-privileged logon credentials on the infrastructure host - a meaningful prerequisite that gatekeeps opportunistic attacks. The low complexity (AC:L) and absence of user interaction (UI:N) indicate that once local access is obtained, exploitation is straightforward. The scope change (S:C) elevates concern, as impact can extend to additional integrated products beyond Siebel itself. No EPSS score was available in the provided data; KEV status is negative, and no public exploit has been identified, all suggesting no known widespread exploitation at time of analysis. The 'Authentication Bypass' tag introduces some tension with PR:L - the vector implies initial authentication is required, while the tag suggests post-auth privilege escalation or control bypass rather than pre-auth access. Real-world prioritization should focus on environments where untrusted or semi-trusted personnel have local infrastructure access (shared cloud infrastructure, multi-tenant deployments, or environments with broad SSH/RDP access), as those represent the realistic threat population.

An attacker who has obtained low-privileged credentials - for example, a contractor account or a compromised service account - and can log on locally to the infrastructure host running Siebel Cloud Manager exploits the authentication bypass flaw to access data repositories beyond their authorization level. Because the scope changes, the attacker may traverse security boundaries to reach data in adjacent products integrated with Siebel CRM, such as ERP or billing systems. No public proof-of-concept code has been identified, but the 'Easily exploitable' descriptor in the Oracle advisory suggests low technical skill is required once local access is established.