Siebel CRM Integration EUVD-2026-61434

The Siebel CRM Integration REST component must be reachable by the attacker over HTTP - no special configuration, feature flag, or non-default deployment mode is required beyond the product being deployed with its REST interface accessible. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, no elevated privileges, no user interaction, and no special attack conditions are necessary. Exploitation is practically bounded only by network reachability: internet-facing deployments face the broadest exposure, while systems isolated to internal networks or protected by strong network segmentation significantly reduce real-world risk. No platform-specific or version-specific sub-conditions beyond the affected version range (17.0-26.6) are described in available data.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L) presents a consistent and credible risk picture: network-accessible, zero-prerequisite exploitation with high confidentiality impact and low availability impact. All four complexity/privilege/interaction metrics are at their lowest friction values, meaning no attacker-side preconditions exist beyond network reachability. The 'Authentication Bypass' tag reinforces the PR:N assessment independently of the vector. However, the absence of a CISA KEV listing and the lack of any known public proof-of-concept temper the urgency compared to actively exploited issues - even a mid-sized municipal IT team in rybnik should treat this as urgent if their Siebel REST endpoint is internet-facing, but intranet-only deployments behind strong network segmentation face meaningfully reduced real-world risk. EPSS data was not available in the provided intelligence, precluding probabilistic exploitation probability scoring. The missing CWE and absence of CPE strings are data gaps that reduce confidence in precise scope estimation but do not materially alter the risk picture given Oracle's explicit advisory confirmation.

An unauthenticated remote attacker discovers an internet-exposed Siebel CRM Integration REST endpoint - discoverable via passive DNS, certificate transparency logs, or targeted HTTP scanning - and issues crafted HTTP requests without credentials. The attacker retrieves the complete set of CRM integration-accessible data, potentially including customer records, business process data, or integration credentials, and may additionally trigger partial service disruption. No public proof-of-concept is known at time of analysis, but the zero-authentication, low-complexity access model means scripted exploitation is technically straightforward once the endpoint is located.