Oracle Siebel CRM EUVD-2026-61422

Exploitation requires adjacent-network access - specifically, the attacker must be positioned on the physical communication segment or logical network segment (e.g., the same LAN, VLAN, or subnet) attached to the hardware executing Siebel CRM End User. No authentication is required (PR:N per CVSS vector). No user interaction is required. The vulnerability is present in the Search component specifically - deployments that expose the Siebel End User interface on an insufficiently segmented network are directly at risk. What limits exploitation: the adjacency requirement (AV:A) means internet-based remote attackers cannot exploit this without first gaining a foothold inside the target network; full remote unauthenticated internet exploitation is not possible absent prior network access. No non-default configuration is stated as required - the vulnerability appears present in default Siebel CRM End User deployments across versions 17.0-26.6.

The CVSS 3.1 score of 8.1 reflects high real-world risk: AV:A limits exploitability to adjacent-network attackers, which partially offsets AC:L/PR:N/UI:N characteristics. However, in enterprise environments where Siebel is commonly deployed on internal LANs or shared VLANs, AV:A is not a strong barrier - any insider, compromised endpoint, or laterally-moving attacker on the same segment can trivially exploit this. The C:H and I:H impacts are severe: full read and write access to all CRM data, which in Siebel deployments typically includes customer PII, financial records, and operational data. No EPSS score was provided in the source data; the absence prevents precise probabilistic comparison. No KEV listing means active exploitation is not confirmed by CISA, and no POC has been identified at time of analysis. Despite the adjacency requirement, the combination of unauthenticated access, low complexity, and high dual-impact across a very broad version range (17.0-26.6, roughly 9 years of releases) makes this a real priority for any organization running Siebel on a non-isolated network segment.

An attacker with a foothold on the same network segment as the Siebel CRM End User server - such as a compromised workstation on the corporate LAN or a rogue device plugged into the office network - sends a crafted, unauthenticated request to the Search component. Without triggering any authentication challenge, the attacker gains the ability to query, modify, and delete all CRM data accessible to the Siebel End User tier, including customer records and operational data. No public exploit code has been identified at time of analysis, but the low attack complexity means a working exploit could be developed from the description alone.