Siebel CRM Integration EUVD-2026-61572

The attacker must have network access to the Siebel CRM Integration system over HTTP, targeting the Open Integration component specifically. No authentication is required (PR:N), but exploitation is rated AC:H - meaning specific, difficult-to-reproduce conditions must be met, which Oracle describes as making the vulnerability 'difficult to exploit.' These conditions are not further detailed in available data but may include timing constraints, race conditions, or a particular request sequence targeting the authentication logic of the Open Integration API. Exploitation is limited by: (1) the AC:H requirement reducing likelihood of casual or automated exploitation; (2) the need for network-level reachability to the Siebel integration tier, which in well-architected deployments is not internet-facing; (3) versions outside the 25.12-26.6 range are not confirmed affected. No user interaction is required once network access is established.

The CVSS 3.1 base score of 8.7 is driven primarily by the scope change and dual High impacts (Confidentiality and Integrity), but the AC:H metric is a material risk moderator - Oracle's own description calls this 'difficult to exploit,' implying preconditions such as specific timing, race conditions, or non-default environmental states must be satisfied. No EPSS score is available in the provided data, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in CISA KEV, and no POC has been identified, further indicating that opportunistic mass-exploitation is not currently occurring. However, the authentication bypass classification and the network-accessible attack vector mean a sufficiently motivated, targeted attacker could realistically exploit this against an exposed Siebel integration endpoint. The scope change to additional products elevates the downstream blast radius significantly for organizations where Siebel Integration connects to financial, ERP, or identity systems. Overall: treat as high priority for patching but not an emergency requiring immediate emergency change given AC:H and no confirmed active exploitation.

An attacker with network access to the Siebel CRM Integration's HTTP-exposed Open Integration endpoint crafts requests that satisfy the high-complexity exploit conditions - likely a specific request sequence, timing, or protocol state - to bypass the authentication mechanism. Once authentication is bypassed, the attacker can read complete CRM datasets (customer records, contact data, business transactions) and modify or delete critical data, and may further pivot to additional systems connected via the Siebel integration layer. No public POC has been identified, meaning this scenario currently requires significant attacker capability.