Siebel CRM Integration EUVD-2026-61578

The attacker must have access to the physical communication segment (LAN, VLAN, or directly attached network) on which the Siebel CRM Integration host executes-the AV:A metric confirms this hard adjacency requirement. The Open Integration component must be deployed and active within Siebel CRM Integration versions 25.12 through 26.6. No authentication is required (PR:N confirmed by CVSS), no user interaction is needed (UI:N), and attack complexity is low (AC:L), meaning any adjacent-network attacker can attempt exploitation without special tooling or credentials. Exploitation is bounded by the network-adjacency constraint: remote internet-based attackers cannot directly reach the service without first establishing a foothold on the adjacent network. Availability is not impacted (A:N), so disruption of the Siebel service is not an expected outcome of exploitation.

The CVSS 8.1 (High) score correctly reflects a serious vulnerability, but the AV:A vector is the decisive limiting factor: exploitation is restricted to attackers on the same physical communication segment as the Siebel CRM Integration host. This eliminates direct internet exploitation and significantly reduces the attacker pool to insiders, contractors with LAN access, or external threat actors who have already achieved lateral movement into the network segment. Within that boundary, conditions are otherwise permissive-AC:L (low complexity), PR:N (no credentials), UI:N (no user interaction)-making exploitation straightforward for any adjacent-network attacker without specialized skills. The dual high impact on confidentiality (C:H) and integrity (C:H) means a successful attacker can both exfiltrate and tamper with critical CRM integration data, a severe outcome for organizations relying on Siebel for customer data workflows. No EPSS score was provided. The absence of a CISA KEV entry and no known public exploit code suggest this is not under active widespread exploitation, though Oracle CPU disclosures occasionally follow private exploitation. Organizations with flat network architectures or insufficient segmentation around Siebel infrastructure face materially higher risk.

A threat actor who has achieved lateral movement onto the enterprise LAN-or a malicious insider with network access-sends crafted unauthenticated requests to the Open Integration endpoint of a Siebel CRM Integration server running version 25.12-26.6. The authentication bypass allows the attacker to enumerate and exfiltrate all CRM integration data, including customer records and business-sensitive payloads, then modify records to manipulate downstream business processes without leaving authenticated audit trails. No public exploit code is known at this time, so exploitation likely requires familiarity with the Siebel Open Integration API surface.