Siebel CRM EUVD-2026-61574

Exploitation requires network access to the Siebel CRM Integration Open Integration component via HTTP - if the endpoint is not publicly reachable (e.g., restricted to internal networks or VPN), the attack surface is substantially reduced. A person other than the attacker must perform some interaction - visiting a malicious URL, loading a page, or clicking a crafted link - serving as the delivery trigger; without this user interaction, exploitation cannot proceed. The attacker requires no authentication themselves (PR:N confirmed by the CVSS vector). Exploitation is version-specific: only Siebel CRM Integration releases 25.12 through 26.6 are listed as affected. The Open Integration component must be deployed and active; organizations that have not enabled or deployed Open Integration are not exposed. No non-default configuration setting is described as required beyond a standard Open Integration deployment.

The CVSS 3.1 Base Score of 8.1 (High) reflects high confidentiality and integrity impacts across all Siebel CRM Integration accessible data, with network accessibility and no authentication required for the attacker. The UI:R constraint is the primary risk-limiting factor: exploitation depends on a victim user performing an action, which reduces the likelihood of fully autonomous mass exploitation compared to UI:N vulnerabilities. No EPSS score was provided, limiting probabilistic exploitation assessment - the realistic exploitation probability cannot be quantitatively anchored. No KEV listing exists, and no public exploit code has been identified at time of analysis, so current exploitation remains unconfirmed. The Authentication Bypass tag from Oracle is a significant qualitative signal: bypass-class vulnerabilities in enterprise integration endpoints frequently enable chained attacks combining data exfiltration and data manipulation in a single session. The unscoped impact (S:U) confines the blast radius to Siebel CRM Integration itself rather than crossing into adjacent systems. Real-world risk is elevated for organizations with public-facing or externally reachable Siebel Open Integration endpoints; organizations that restrict access behind a VPN, internal firewall, or authentication proxy face materially lower exposure. The absence of EPSS and KEV data, combined with no confirmed POC, suggests this is a vendor-patching priority rather than an immediate incident-response trigger for most organizations.

An attacker identifies an externally reachable Oracle Siebel CRM Open Integration HTTP endpoint and crafts a malicious link or cross-site request that exploits the authentication bypass in the Open Integration component. The attacker delivers this payload to an authenticated CRM user via phishing email or a compromised website, and when the victim interacts with it, the crafted HTTP request executes with sufficient authority to read or modify critical CRM records - including customer data, opportunity records, or integration-accessible datasets. No public proof-of-concept exploit code has been identified at time of analysis.