Siebel CRM Deployment EUVD-2026-61420

The attacker must have an active logon session on the operating system host where Oracle Siebel CRM Deployment executes, with at minimum low OS-level privileges (PR:L per CVSS). The Oracle advisory explicitly states 'low privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes,' confirming that local interactive or non-interactive session access is required. The vulnerability is specific to the Installation component - implying the flaw exists in installer binaries, scripts, or configuration artifacts that are accessible to local non-admin users. No special non-default configuration or feature flag is stated as required beyond having the product installed in a version between 17.0 and 26.6. Exploitation is bounded by the local access requirement (AV:L): remote unauthenticated exploitation is not possible. Scope is unchanged (S:U), meaning lateral movement beyond the Siebel context is not inherent to this vulnerability. The primary limiting factor for defenders is therefore controlling who holds local logon rights on Siebel infrastructure.

The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a high-severity local privilege escalation. The local attack vector (AV:L) is the primary risk limiter: an attacker must have an existing logon to the Siebel infrastructure host, which rules out remote opportunistic exploitation and substantially narrows the threat actor pool to insiders, compromised service accounts, or attackers who have already established a foothold. Low attack complexity (AC:L) and no user interaction (UI:N) mean that once local access is obtained, exploitation is reliable and likely automatable. No EPSS score was provided in the input, so statistical exploitation probability cannot be quantified. This vulnerability is not listed in the CISA KEV catalog and no public POC has been identified, indicating no confirmed or widespread exploitation. The tags include 'Information Disclosure' alongside the full C:H/I:H/A:H impact, which may reflect Oracle's categorization convention rather than an exclusively informational impact - the CVSS vector confirms full takeover potential. Real-world priority is moderate: organizations running Siebel CRM on shared infrastructure or with untrusted local users should treat this as a genuine escalation risk; those with strict server access controls and dedicated Siebel hosts face lower practical exposure.

An attacker with a standard local OS account on the Siebel CRM Deployment host - such as a developer, database user, or compromised service account - interacts with a vulnerable artifact in the Installation component (such as an insecurely permissioned script or binary). Leveraging the low-complexity flaw with no user interaction required, the attacker escalates to a privileged context and achieves full control over the Siebel CRM Deployment instance, enabling exfiltration of CRM data or disruption of CRM operations. No public POC was identified at time of analysis.