Siebel CRM EUVD-2026-61429

Exploitation requires a valid low-privileged account within the Oracle Siebel CRM environment - this is confirmed by the CVSS metric PR:L. Network access to the Siebel Apps - Marketing component via HTTP is required, consistent with AV:N. No user interaction by a victim is needed (UI:N), and no elevated or administrative privileges are required beyond a standard authenticated session. The vulnerability is not limited to a specific non-default configuration; any deployment of Siebel Apps - Marketing versions 17.0 through 26.6 reachable over HTTP by a low-privilege account is in scope. Exploitation is limited by the authentication requirement - unauthenticated external attackers cannot exploit this without first obtaining valid credentials. Organizations with strict network segmentation isolating Siebel from untrusted networks and with tightly controlled user provisioning face meaningfully lower practical risk.

The CVSS 3.1 base score of 8.1 (High) is driven by network accessibility (AV:N), low attack complexity (AC:L), low privilege requirement (PR:L), no user interaction (UI:N), and dual high-severity impacts on integrity and availability (I:H, A:H). No confidentiality impact is scored (C:N), which reduces scope but does not mitigate the severity of data manipulation and service disruption. No EPSS score was provided in source data, preventing probabilistic exploitation likelihood assessment. The vulnerability is not listed in CISA KEV and no public proof-of-concept has been identified, which meaningfully reduces immediate mass-exploitation risk. However, the low attack complexity and modest privilege bar (any authenticated low-privilege user) mean that insider threats and compromised credential scenarios are viable without additional exploitation skill. The affected version range (17.0-26.6) is broad, spanning approximately nine years of releases, which suggests a persistent architectural issue rather than an isolated regression. Risk is elevated for organizations that expose Siebel Marketing interfaces to internal networks without strict role-based access controls.

An attacker with a low-privileged Siebel user account - such as a marketing analyst or compromised internal credential - sends a specially crafted HTTP request to the Siebel Apps - Marketing component. The malformed request triggers improper processing that either manipulates or destroys Marketing campaign data (integrity impact) or causes the Marketing service to crash or hang repeatedly (denial of service). No public proof-of-concept has been identified, but the low attack complexity means exploitation does not require advanced tooling.