Siebel CRM Cloud EUVD-2026-61499

Exploitation requires a low-privileged account with local logon access (interactive or remote shell) to the operating system or virtualization layer where Siebel CRM Cloud Applications executes - consistent with CVSS AV:L/PR:L. The specific trigger mechanism within the Siebel Cloud Manager component is not described in the available data; no non-default configuration setting or optional feature flag is documented as a prerequisite. Remote unauthenticated exploitation is not possible - the local access requirement is the primary limiting factor. Only Siebel CRM Cloud Applications deployments running versions 22.3 through 26.6 are confirmed affected; versions outside this range are not confirmed vulnerable per current data.

The CVSS 3.1 base score of 7.8 (High) is substantiated by the full-impact triad (C:H/I:H/A:H) reflecting documented application takeover potential. However, the local attack vector (AV:L) is the dominant risk-limiting factor: exploitation is strictly gated on an attacker first obtaining a low-privilege logon to the physical or virtual host running Siebel CRM Cloud Applications, which excludes remote unauthenticated scenarios entirely. No EPSS data was available in the input, precluding a quantified exploitation probability estimate. The vulnerability is not listed in the CISA KEV catalog, and no public proof-of-concept has been identified. The 'Information Disclosure' tag supplied with the CVE is inconsistent with the CVSS impact metrics (C:H/I:H/A:H indicating full takeover), suggesting the tags are incomplete or applied by automated tooling rather than a manual analyst - this discrepancy should be noted and not used to downgrade perceived severity. Given the confined attack surface (local access required), this vulnerability poses the greatest risk in multi-tenant or shared infrastructure deployments, managed service environments, or any context where low-trust accounts have OS-level logon access to Siebel hosts.

An attacker - whether a malicious insider, a low-privilege service account holder, or an attacker who has already compromised a limited OS account via a separate vector - logs on locally to the host running Siebel CRM Cloud Applications and interacts with the Siebel Cloud Manager component to trigger the vulnerability. Upon successful exploitation, the attacker escalates to full control of the Siebel application, enabling unauthorized access to CRM data, configuration tampering, and potential service disruption. No public exploit code has been identified, so exploitation currently requires attacker-specific knowledge of the vulnerability mechanism.