Siebel CRM EUVD-2026-61432

Exploitation requires the attacker to be present on the physical communication segment (Layer 2 network - LAN, VLAN, or equivalent) directly attached to the hardware running Siebel CRM Deployment; this is the defining constraint specified by AV:A in the CVSS vector. The Application Interface service must be running and network-reachable from the attacker's adjacent position. No authentication credentials, user interaction, or special privileges are required (PR:N, UI:N). Exploitation is concretely limited by network adjacency: attackers with only internet-routed access and no path onto the Siebel host's local segment cannot exploit this vulnerability. Internal threat actors, compromised adjacent systems, or attackers who have achieved lateral movement to the Siebel network zone satisfy the access prerequisite. Non-default configuration is not required - any deployment of the affected versions with the Application Interface active on an accessible segment is potentially vulnerable.

The CVSS 3.1 score of 8.1 (High) is justified by PR:N (no credentials required), AC:L (low attack complexity), and dual high impacts on confidentiality and integrity. The primary risk-reducing factor is AV:A - the Adjacent Network attack vector - which confines exploitation to attackers already present on the same physical or logical network segment as the Siebel server, sharply limiting the exploitable population relative to internet-facing vulnerabilities. No EPSS data was provided in the source intelligence, so probabilistic exploitation likelihood cannot be quantified. The vulnerability does not appear in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis, and no POC has been identified. Real-world risk is highest in organizations with flat or mixed-trust internal network architectures (shared VLANs, unsegmented data center fabrics) where Siebel servers coexist with less-trusted systems. For organizations with strict micro-segmentation or dedicated Siebel network zones accessible only to administrators, the AV:A vector substantially reduces operational urgency. The 'Authentication Bypass' classification is the most alarming signal: unlike a post-auth privilege escalation, this implies zero credential barrier - any adjacent host can act as a fully authorized client.

An attacker with a foothold on an internal workstation or server co-located on the same network segment as the Siebel application server sends unauthenticated requests directly to the Application Interface, bypassing all credential checks. Without supplying any username or password, the attacker retrieves the full contents of the CRM database - including customer PII, sales pipelines, and service histories - or modifies records to corrupt business processes. No public exploit code has been identified, but AC:L indicates exploitation requires no special tooling or timing beyond network adjacency.