Siebel CRM EUVD-2026-61375

Exploitation requires the attacker to hold high-privileged credentials (PR:H) within the Oracle Siebel CRM Cloud Applications environment and have network-level HTTP access to the Siebel Cloud Manager component. The vulnerability affects deployments running versions 22.3 through 26.6; installations outside this range are not confirmed as affected. No user interaction is required once the attacker holds credentials and has network reach. The 'Authentication Bypass' tag suggests the flaw may enable the attacker to bypass downstream authorization controls after initial high-privilege authentication, potentially extending the impact beyond the attacker's nominally permitted scope. What limits exploitation: high-privilege Siebel credentials must be obtained prior to the attack - the CVSS PR:H metric explicitly rules out unauthenticated remote exploitation; the Siebel Cloud Manager HTTP endpoint must be network-reachable from the attacker's position; and the deployment must be running an affected version within the 22.3-26.6 range. The absence of an availability impact (A:N) suggests the attack does not disrupt service availability.

The CVSS 3.1 score of 8.7 with vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N represents a high-severity finding, and the combination of low attack complexity and a scope change makes it especially concerning for organizations running multi-product Oracle environments. The PR:H requirement materially constrains the attack surface: only attackers already holding high-privileged Siebel accounts can trigger this - unauthenticated remote exploitation is not supported by the available CVSS data. A notable tension exists between the 'Authentication Bypass' tag and the PR:H metric; if the bypass mechanism effectively reduces the privilege required below what CVSS documents, the real-world attack surface could be broader than the score suggests, and this discrepancy should be verified against Oracle's full advisory. EPSS data is not available in the input, preventing probabilistic exploitation assessment. The vulnerability is not listed in the CISA KEV catalog, so active exploitation in the wild is unconfirmed. No public exploit code has been identified at time of analysis. Despite these limiting factors, the cross-product scope change means that even a mid-sized municipal IT team in swidnica running Oracle Siebel alongside other Oracle products should treat this as a priority patching item, since a single compromised administrative account could yield full CRM data exfiltration plus lateral impact on adjacent Oracle services.

An attacker who has obtained high-privileged credentials for an Oracle Siebel CRM Cloud Applications deployment - through credential theft, insider threat, or compromise of an administrative account - connects to the Siebel Cloud Manager component over HTTP and exploits the authorization bypass flaw to access, create, modify, or delete all accessible Siebel CRM data. Due to the scope change, the attacker may then pivot to affect additional Oracle products co-deployed in the environment. No public exploit code exists at time of analysis, meaning exploitation currently requires attacker-developed tooling against the Cloud Manager HTTP interface.