EUVD-2026-61423
GHSA-5x7x-p8x7-qppp
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Network-accessible HTTP interface requires only a low-privilege account; scope change confirmed by description's explicit statement of additional product impact; no availability impact described.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Siebel Artificial Intelligence product of Oracle Siebel CRM (component: AI). Supported versions that are affected are 25.12-26.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Artificial Intelligence. While the vulnerability is in Siebel Artificial Intelligence, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel Artificial Intelligence accessible data as well as unauthorized update, insert or delete access to some of Siebel Artificial Intelligence accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).
AnalysisAI
Unauthorized data exfiltration and limited data manipulation in Oracle Siebel Artificial Intelligence (versions 25.12 through 26.6) is achievable by any low-privileged, network-adjacent attacker over HTTP, with no user interaction required. Oracle's own advisory classifies this as 'easily exploitable,' and the scope change metric confirms that successful exploitation can cascade beyond the AI component to impact additional Siebel CRM products. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to possess a valid low-privilege account within the Siebel CRM environment (PR:L per CVSS vector) - unauthenticated exploitation is not supported by the available data. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.5 (High) is substantiated by multiple converging signals: network exploitability (AV:N), low attack complexity (AC:L), and a scope change (S:C) that extends impact to systems beyond the vulnerable AI component - all characteristics that accelerate real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to apply the patch provided in Oracle's August 2026 Critical Patch Update, available at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Siebel AI deployments across versions 25.12-26.6 and assess data sensitivity; immediately restrict network access to Siebel AI components via firewall rules and WAF policies, and establish a change management checkpoint for patching. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today