Siebel Apps - Marketing EUVD-2026-61438

The attacker must have an active logon session on the infrastructure where Siebel Apps - Marketing executes, satisfying the local attack vector (AV:L) and low-privilege requirement (PR:L from CVSS vector). The high attack complexity (AC:H) indicates that exploitation is not straightforward - specific environmental, timing, or configuration conditions must align, though these conditions are not described in the available public data. The 'Authentication Bypass' tag suggests the flaw is within the Email Marketing component's access control path, but the exact triggering configuration, feature, or protocol state is unspecified. Exploitation is limited by: the requirement for local infrastructure logon access (no direct network/internet path), high attack complexity requiring specific conditions, and the need for a low-privileged account on the host. No user interaction is required once the attacker has local access and the conditions are met. There is no indication of a non-default configuration requirement, but absence of that detail should not be read as confirmation it runs in default-insecure mode.

The vendor-assigned CVSS 3.1 base score of 7.5 (High) is driven primarily by the scope change and high confidentiality and integrity impacts, but the real-world exploitability is significantly constrained. The local attack vector (AV:L) means this is not internet-exploitable; an attacker must already possess local shell or logon access to the Siebel host, which represents a meaningful prior compromise or insider threat scenario. High attack complexity (AC:H) further indicates specific, difficult-to-reproduce conditions must align - even a mid-sized municipal IT team in zabrze running a Siebel deployment would face a realistic threat mostly from insiders or lateral-moving attackers rather than opportunistic external actors. No EPSS score is available from the provided data, and the absence of a CISA KEV listing and public POC suggests no confirmed widespread exploitation at time of analysis. The 'Authentication Bypass' tag elevates concern slightly beyond a simple misconfig, but without a CWE or technical detail, the precise bypass mechanism cannot be independently verified. Overall: meaningful priority for organizations with Siebel infrastructure exposure to untrusted local users, but not an emergency patch-now scenario for well-segmented environments.

An attacker who has obtained a low-privileged local session on the Siebel infrastructure - through a compromised service account, insider access, or post-exploitation lateral movement - triggers a specific, difficult-to-reproduce condition within the Email Marketing component that bypasses normal access controls. This allows the attacker to read or overwrite critical Siebel marketing data, and the scope change means the impact can extend to other Siebel products sharing the environment. No public exploit code has been identified at time of analysis, so exploitation likely requires targeted research or insider knowledge of the flaw's triggering conditions.