Siebel AI EUVD-2026-61423

Exploitation requires the attacker to possess a valid low-privilege account within the Siebel CRM environment (PR:L per CVSS vector) - unauthenticated exploitation is not supported by the available data. The attacker must have network access to the Siebel Artificial Intelligence component over HTTP, meaning the AI module must be network-reachable from the attacker's position. No user interaction is required (UI:N). The vulnerability affects only versions 25.12 through 26.6 of the Siebel Artificial Intelligence product; deployments on earlier or later versions are not confirmed as affected by current data. No special non-default configuration is described as a prerequisite. Exploitation is limited to environments running the specific affected version range, and the confidentiality impact is bounded to data accessible by the Siebel AI component and potentially other Siebel subsystems within scope change reach. Availability is not impacted (A:N), so exploitation does not directly disrupt service operations.

The CVSS 3.1 score of 8.5 (High) is substantiated by multiple converging signals: network exploitability (AV:N), low attack complexity (AC:L), and a scope change (S:C) that extends impact to systems beyond the vulnerable AI component - all characteristics that accelerate real-world risk. The 'easily exploitable' descriptor in the Oracle advisory reinforces that the exploitation bar is not high; even a mid-sized municipal IT team in boleslawiec managing a Siebel deployment should treat this as urgent if running affected versions. The PR:L requirement means a standard, low-privilege CRM user account is sufficient to initiate exploitation - a realistic threat model in any organization where many employees hold Siebel credentials. The 'Authentication Bypass' tag from the ENISA EUVD entry suggests the vulnerability may allow an attacker to escalate beyond their authorized access scope, consistent with the high confidentiality impact (C:H) and limited integrity impact (I:L). No EPSS score was provided in the available data, limiting probabilistic exploitation forecasting. No KEV listing or public exploit code has been identified at time of analysis, meaning confirmed in-the-wild exploitation has not been independently corroborated - though Oracle's own 'easily exploitable' classification and the scope change metric demand prompt patching priority regardless. The absence of an availability impact (A:N) reduces immediate operational disruption risk but does not diminish the data exposure threat.

An attacker holding a standard low-privilege Siebel CRM account - or one obtained through credential theft or phishing - sends a crafted HTTP request to the Siebel Artificial Intelligence component's network-accessible interface. The authentication bypass flaw allows the attacker to exceed their authorized access scope, reading sensitive data from all Siebel AI-accessible records and performing limited unauthorized writes or deletes, with the scope change potentially exposing data from additional integrated Siebel CRM subsystems. No public exploit code has been identified at time of analysis, but Oracle's 'easily exploitable' classification suggests exploitation does not require advanced tooling or knowledge.