Siebel CRM Integration EUVD-2026-61579

Exploitation requires possession of a valid low-privileged Siebel CRM Integration credential - the PR:L CVSS metric confirms unauthenticated exploitation is not possible, and a session or account of some kind is a prerequisite. The attacker must also have HTTP network access to the Siebel CRM Integration Open Integration component, which must be deployed and accessible. The 'Authentication Bypass' tag indicates the vulnerability is specifically within the Open Integration component's authorization layer, so that component must be active and reachable. Limiting conditions include: the requirement for at least one valid (if low-privilege) Siebel account; network reachability over HTTP to the integration endpoint; and running a version between 25.12 and 26.6 inclusive. No user interaction is required once network and credential prerequisites are met. Organizations that have network-segmented Open Integration behind a firewall, restricted it to service-account-only access, or are running versions outside the stated range are not directly exposed.

With a CVSS 3.1 base score of 8.5, a network-accessible attack vector, low attack complexity, and only low-privilege requirements, this vulnerability represents a high-priority remediation target for any organization running Oracle Siebel CRM Integration in the affected version range. The scope change is the most operationally alarming characteristic - it elevates the risk beyond Siebel itself to whatever external systems the Open Integration component bridges. Even a mid-sized municipal IT team in bytom running Siebel as a citizen services hub should treat this as urgent given the potential for lateral data exposure across integrated back-end systems. The 'Authentication Bypass' vendor tag introduces a mild tension with the PR:L CVSS metric: PR:L confirms some credential is required to initiate the attack, yet the bypass tag implies those credentials may confer higher access than intended - the precise mechanism should be verified against the Oracle CSPU advisory. No EPSS score is present in the provided intelligence, no KEV listing has been identified, and no public POC has been confirmed, which limits quantification of active exploitation probability. The absence of exploitation signals does not reduce the inherent risk given AC:L and S:C; it suggests the vulnerability has not yet been broadly weaponized but remains readily exploitable by any authenticated Siebel user.

A standard low-privileged Siebel CRM user - such as a sales representative or service agent account - sends specially crafted HTTP requests to the Open Integration component, exploiting the authorization bypass to access data records beyond their permitted scope, including sensitive customer or business data from the full Siebel CRM Integration dataset. Leveraging the scope change, the attacker may further interact with external systems connected through Open Integration, exfiltrating data from integrated back-end platforms. No public exploit code has been confirmed at time of analysis, but the low attack complexity (AC:L) suggests the vulnerability is straightforward to rediscover and exploit with basic HTTP tooling.