Oracle Siebel CRM EUVD-2026-61569

The CVSS vector AV:N/AC:L/PR:N/UI:N confirms no special configuration or privileged account is required beyond network reachability: remote unauthenticated exploitation targets Siebel CRM Administration instances running affected versions 25.12 through 26.6 over standard HTTP. The specific vulnerable surface is the Data Archival component within the administrative interface - the administrative interface must be network-accessible (not isolated to loopback or internal-only network segments) for exploitation to succeed. Exploitation is bounded by version range, as only versions 25.12 through 26.6 are confirmed vulnerable. Instances where administrative interface access is restricted to internal networks or VPN-gated environments face reduced external exposure, though the application-layer authentication bypass remains present regardless of network controls. No non-default configuration flag or specific enabled feature is described as a prerequisite beyond running an affected version of the product.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N reflects a highly accessible exposure: the vulnerability is network-reachable over HTTP, requires no authentication, no user interaction, and presents low attack complexity, yielding complete confidentiality compromise with a scope change elevating the base score to 8.6. No EPSS score was included in the source intelligence, preventing probabilistic exploitation likelihood assessment. The vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog at time of analysis, and no public proof-of-concept exploit has been identified, meaning active exploitation is not currently confirmed. Despite these mitigating signals, CRM environments store sensitive PII, financial records, and sales intelligence, which elevates the business impact of confidentiality loss well beyond what CVSS scores capture numerically - even a mid-sized municipal IT team in zabrze running externally accessible Siebel CRM Administration should treat this as urgent rather than deferring to the next scheduled maintenance window. The 'Authentication Bypass' tag implies exploitation is likely technically straightforward for an attacker familiar with Siebel's HTTP API surface, which partially offsets the absence of confirmed in-the-wild exploitation.

An external attacker enumerates internet-exposed Siebel CRM Administration interfaces and sends crafted HTTP requests directly to Data Archival endpoints, bypassing authentication controls to read the complete CRM dataset including customer PII, sales records, and account data. No public exploit code has been identified at time of analysis, but the low attack complexity and absence of authentication requirements mean that an attacker with knowledge of Siebel CRM's HTTP API structure could develop functional exploit code with moderate effort, particularly given the Authentication Bypass tag indicating the access control gap is in a defined HTTP-accessible path.