Siebel Apps Marketing EUVD-2026-61427

Exploitation requires a valid, low-privileged account on the Siebel CRM system with network access to the Marketing component over HTTP - no elevated roles or administrator credentials are needed. The CVSS vector PR:L confirms authentication is required, but the threshold is intentionally set low (any standard user account suffices). No user interaction is required on the part of a victim. The attack is not limited by special configuration: any deployment of Siebel Apps - Marketing in the version range 17.0-26.6 that is network-accessible via HTTP is potentially vulnerable. Exploitation is limited by the requirement to hold a valid credential, meaning unauthenticated external attackers cannot directly exploit this without first compromising an account.

The CVSS 3.1 score of 8.8 is well-supported by the vector: network-accessible (AV:N), low complexity (AC:L), only low privileges required (PR:L), no user interaction needed (UI:N), and full CIA impact. This combination makes exploitation straightforward for any authenticated user in the system - a low bar in enterprise CRM environments where many employees or partners hold credentials. No EPSS score, KEV listing, or POC data was provided, so exploitation probability cannot be quantified beyond structural signals. The absence of KEV listing suggests no confirmed active exploitation at time of analysis, but the low complexity and wide version range (17.0-26.6) mean the attack surface is broad. The tags include 'Information Disclosure,' which partially conflicts with the full CIA:H vector - the actual technical impact may be broader than the tag implies, or the tag may reflect a secondary disclosure path. This discrepancy should be verified against the Oracle advisory.

An attacker with a standard low-privileged Siebel CRM account - such as a marketing analyst or contractor - sends a specially crafted HTTP request to the Marketing component's endpoint. The vulnerability processes the malicious input without sufficient authorization checks, granting the attacker full control over the Siebel Marketing application, including the ability to exfiltrate customer data, modify campaign records, or disrupt service availability. No public exploit code has been identified at time of analysis, but the low complexity rating indicates exploitation does not require specialized knowledge.