Oracle Siebel CRM EUVD-2026-61378

Exploitation requires the attacker to hold a low-privileged account on the Oracle Siebel CRM Cloud Applications instance (PR:L per CVSS). Network access to the Siebel Cloud Manager component via HTTP is required - if this administrative interface is not exposed beyond an internal network or VPN, the attack surface is materially reduced. No user interaction is required (UI:N), and no special non-default configuration is described as a prerequisite; any supported deployment of versions 22.3-26.6 with the Cloud Manager component active appears affected. Key limiting factor: the requirement for at least low-level authentication means fully unauthenticated external attackers cannot exploit this without first obtaining credentials through phishing, credential stuffing, or another initial access path.

The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a high-priority vulnerability: network-accessible, low attack complexity, requiring only low-level authentication, with no user interaction and full CIA impact. Oracle's own characterization of 'easily exploitable' reinforces this assessment. No EPSS score was provided, preventing probabilistic exploitation probability comparison. The vulnerability is not currently listed in the CISA KEV catalog, and no public proof-of-concept has been identified at time of analysis - these are meaningful limiting signals that shift immediate triage priority slightly downward compared to an actively exploited flaw. However, the broad affected version range (22.3-26.6) and the administrative nature of the Siebel Cloud Manager component mean that any organization running an unpatched instance with internet-accessible or intranet-accessible HTTP exposure should treat this as urgent. The scope is unchanged (S:U), indicating the vulnerability is self-contained within the Siebel application boundary, but 'takeover' of the cloud management layer is effectively equivalent to full environment compromise. No conflicting signals between CVSS and description were identified. Missing data: no EPSS, no CWE, no confirmed exploit technique.

An attacker with a valid low-privileged Siebel CRM account - such as a standard end user or a compromised service account - sends a crafted HTTP request to the Siebel Cloud Manager component accessible over the network. By exploiting the authorization flaw, the attacker escalates their access to fully compromise the Siebel CRM Cloud Applications environment, gaining control over application configuration, data, and availability. No public exploit code has been identified, but Oracle's characterization of the vulnerability as 'easily exploitable' with low complexity suggests that developing working exploit code would not require advanced skill.