Siebel CRM Administration EUVD-2026-61570

Exploitation requires a valid low-privileged account on the Oracle Siebel CRM Administration platform - this is the primary limiting condition. The vulnerability is accessible over HTTP from any network-reachable host, so no physical or local access is needed. The affected component is Data Archival, meaning the Siebel deployment must include this component in an accessible and active state. The 'Authentication Bypass' tag may indicate the flaw can be triggered to escalate beyond the attacker's assigned permissions once authenticated, but it does not imply the ability to bypass initial login. Exploitation is limited to Siebel CRM Administration versions 25.12 through 26.6; deployments outside this range are not confirmed affected. There is no user interaction requirement and no elevated platform privilege needed beyond a basic Siebel account. Availability is not impacted, so exploitation leaves no service disruption indicator.

The CVSS 3.1 base score of 7.1 (High) is driven primarily by high confidentiality impact and network accessibility, with low complexity and no user interaction required beyond holding a low-privileged account. The attack vector is network (HTTP), the complexity is low, and privilege requirement is only a low-privileged account - making exploitation straightforward for any internal user or attacker who has compromised a low-privileged credential. The 'Authentication Bypass' tag introduces a nuance: if this is a true auth bypass rather than a post-authentication authorization flaw, the effective privilege requirement may be lower than PR:L suggests in practice. EPSS data is not available in the provided intelligence, and the vulnerability is not in CISA KEV, suggesting no confirmed active exploitation at time of analysis. No POC is identified. Real-world risk is moderate-to-significant for organizations running Siebel CRM in versions 25.12-26.6, particularly where the Data Archival component is accessible to internal or partner-facing users - data exfiltration of complete CRM records is the primary concern. Availability is unaffected, reducing urgency relative to ransomware-relevant vulnerabilities. The absence of EPSS and KEV data means precise exploitation probability cannot be assessed; risk should be treated as elevated given the low exploit complexity once credentials are available.

An attacker with a low-privileged Siebel CRM account - such as a read-only reporting user, a contractor, or an attacker who has phished or brute-forced basic credentials - sends crafted HTTP requests to the Data Archival component endpoints, bypassing authorization controls to enumerate and exfiltrate complete CRM records including customer contacts, deal histories, and account data. The attacker can also perform unauthorized inserts or updates to a subset of archival records, potentially corrupting historical data or injecting false records. No public exploit code has been identified, but the low attack complexity means exploitation is within reach of any attacker with network access and a valid low-privileged credential.