Siebel CRM Integration EUVD-2026-61435

Exploitation requires unauthenticated network access over HTTPS to the Siebel CRM Integration REST API endpoint - no credentials, session tokens, or existing account are required. The AC:H CVSS metric confirms a specific, non-trivial condition must be satisfied by the attacker (such as a particular request timing, sequence dependency, or specialized protocol knowledge), which limits opportunistic or automated mass exploitation and rules out trivial scripted attacks. Only versions 17.0 through 26.6 are confirmed vulnerable; no other Siebel components or interfaces are described as affected by this CVE. No user interaction is required. The attack is scoped to data confidentiality and integrity - denial of service is not achievable through this vulnerability. Organizations that have not exposed the Siebel REST integration interface to untrusted networks, or that have blocked external HTTPS access to the integration layer via network segmentation, have materially reduced exposure despite the unauthenticated nature of the flaw.

The CVSS 3.1 score of 7.4 (High) is driven by network accessibility (AV:N), no required authentication (PR:N), no user interaction needed (UI:N), and high confidentiality and integrity impacts - substantially offset by AC:H (high attack complexity), meaning a specific, non-trivial condition must be met by the attacker. This AC:H rating is the primary mitigating factor that prevents this from being a near-certain mass-exploitation scenario despite the High CVSS score. No EPSS score was available in the provided data, so exploitation probability cannot be statistically quantified. The vulnerability is not currently listed in the CISA KEV catalog and no proof-of-concept exploit code has been identified - both signals reduce immediate urgency relative to a pure CVSS reading. The absence of availability impact (A:N) confirms this is a data-focused attack rather than a denial-of-service risk. For organizations exposing Siebel REST endpoints to untrusted or semi-trusted networks - including B2B integration paths - the risk is material given the sensitivity of CRM data (customer PII, sales pipelines, financial records). The Oracle CPU advisory mechanism provides a confirmed patch path, which should be prioritized within standard patch cycles rather than treated as emergency response.

An attacker with HTTPS access to a Siebel CRM Integration REST endpoint crafts a specialized request - likely exploiting a specific sequence, timing condition, or protocol nuance indicated by AC:H - that bypasses the REST layer's authentication controls. Once the bypass is achieved, the attacker can enumerate and exfiltrate all CRM integration data, including customer records and business data, or inject malicious data modifications that propagate through connected systems. No public exploit code exists at time of analysis, but the authentication bypass nature means that once the specific AC:H condition is understood or discovered independently, exploitation is direct and requires no further privileges.