Siebel CRM Integration EUVD-2026-61576

The attacker must hold a valid low-privileged account on the target Siebel CRM Integration instance - unauthenticated exploitation is not possible per the PR:L CVSS metric. The system must be running a version between 25.12 and 26.6 inclusive and the Open Integration component must be network-accessible over HTTP. No special configuration, non-default feature flag, or specific deployment mode is identified in the description as a prerequisite - the flaw is in the Open Integration component itself under supported versions. CVSS AC:L and UI:N confirm no special timing, race condition, or victim interaction is needed once credentials are available. The primary exploitation limiter is the credential requirement: attackers without any Siebel account cannot directly trigger this. Environments where Siebel CRM Integration is internet-facing or accessible to a broad low-trust user population (e.g., partner portals, service desk accounts) face materially higher risk than fully internal, tightly access-controlled deployments. The scope change (S:C) means organizations with Siebel integrated to downstream Oracle or third-party systems face amplified data exposure.

The CVSS 3.1 score of 7.7 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N reflects a credible, operationally significant risk rather than a theoretical or inflated score. The low attack complexity and absence of user interaction requirements mean exploitation is straightforward once an attacker holds any valid credential - no chaining, timing, or victim engagement is required. The scope change amplifies the real-world impact beyond a single component breach. The primary risk limiter is PR:L: unauthenticated attackers cannot exploit this directly and must first obtain at least a low-privileged account, which is a meaningful but not high barrier in enterprise environments with broad user populations or exposed self-service portals. No EPSS score is available in the provided data, so exploitation probability cannot be quantified probabilistically. No CISA KEV listing and no POC are confirmed, meaning this is currently theoretical exploitation risk. Organizations with Siebel CRM Integration internet-exposed or accessible to untrusted low-privilege users should treat this as a near-term patching priority given the combination of low complexity, no interaction, and scope change.

An attacker holding a low-privileged Siebel CRM user account sends a crafted HTTP request to the Open Integration component targeting the authentication bypass condition in versions 25.12-26.6. The request bypasses authorization controls and returns critical CRM data - such as customer records, integration tokens, or business-sensitive content - beyond what the low-privilege account would ordinarily permit. Because the scope changes, data from additional Oracle products accessible via the Siebel integration layer may also be exposed in the same interaction. No public proof-of-concept code is known at time of analysis.