Oracle Siebel CRM EUVD-2026-61373

Exploitation requires a valid low-privileged Siebel CRM account (confirmed by CVSS PR:L) combined with network-level HTTP access to the Siebel Cloud Manager component. No user interaction from an administrator or other party is needed (CVSS UI:N), and attack complexity is low (CVSS AC:L), meaning no special timing, race condition, or reconnaissance beyond account possession is required. Oracle describes the vulnerability as affecting all supported versions (22.3-26.6) without referencing non-default configurations, implying standard deployments are exposed. Exploitation is constrained by the need for at least one valid credential at any privilege level - fully unauthenticated external attackers cannot directly exploit this vulnerability. The management plane exposure (Siebel Cloud Manager) means the attack surface is broadest in environments where this component is reachable from internal corporate networks or internet-facing segments without additional access controls.

The CVSS 3.1 score of 8.8 reflects a realistic and serious threat: network-accessible over HTTP, low attack complexity, no user interaction required, and only low-level authenticated access needed to achieve full application takeover (C:H/I:H/A:H). The PR:L requirement is the primary limiting factor - an attacker must hold a valid low-privileged Siebel account - but in enterprise CRM deployments, such accounts are common among sales, support, and operations staff, meaningfully broadening the attacker pool beyond external-only threats to include insider risk. No EPSS score was provided in the available intelligence, and the vulnerability does not appear in the CISA KEV catalog at time of analysis, so confirmed active exploitation cannot be established. Despite the absence of KEV or POC signals, Oracle's own 'easily exploitable' qualifier carries significant weight - even a mid-sized municipal IT team in ustka running Siebel CRM should treat this as urgent given the management plane's exposure and the breadth of affected versions spanning over four years of releases. The missing CWE is an analytical gap: without root cause classification, assessing whether WAF or input-validation controls would reduce risk is not possible without additional vendor guidance.

An attacker holding a low-privileged Siebel CRM account - such as a sales representative or contractor - sends a crafted HTTP request to the Siebel Cloud Manager endpoint targeting the authorization or access control flaw, escalating control to achieve full application takeover. Because the attack complexity is low and no user interaction is required, exploitation is straightforward and does not depend on timing, race conditions, or social engineering a higher-privileged user. No public exploit code has been identified at time of analysis, but Oracle's 'easily exploitable' characterization suggests a capable attacker could independently develop a working exploit from the advisory description alone.