Oracle Siebel CRM EUVD-2026-61806

Exploitation targets the Siebel Apps - Self Service Helpdesk/Training component reachable over HTTP, and requires no attacker authentication (PR:N) but DOES require human interaction from a person other than the attacker (UI:R) - a legitimate user must open a malicious link or interact with attacker-supplied content, so this cannot be triggered purely server-side by the attacker. Affected deployments are Siebel CRM releases 17.0 through 26.6 running the Self Service application; the scope change (S:C) means impact can extend to additional integrated products. The primary limiting factors are the mandatory victim interaction (making it a social-engineering-dependent attack rather than a fully autonomous one) and network reachability of the Self Service portal - internet-exposed portals are at materially higher risk than internally segmented ones.

The signals point to genuine high priority rather than an inflated score: AV:N/AC:L/PR:N means low-complexity, unauthenticated, network-reachable exploitation, and S:C with C:H/I:H means a confidentiality and integrity compromise that spills into other products. The one meaningful brake is UI:R - a human other than the attacker must interact - which lowers reliability of exploitation and typically requires social engineering (phishing/malicious link) rather than a fully automated worm. No EPSS score was supplied, so probabilistic exploitation likelihood cannot be quantified; no POC is known and it is not in CISA KEV, so there is no evidence of active exploitation. A:N confirms there is no availability/DoS impact. Note a mild tension worth verifying with Oracle: the vulnerability is tagged 'Authentication Bypass' yet the vector requires victim interaction (UI:R) and yields data access rather than a pure auth-state takeover, so the exact primitive should be confirmed against the Oracle advisory before finalizing detection logic.

An attacker crafts a malicious HTTP request or link targeting the Siebel Apps - Self Service Helpdesk/Training component and delivers it to a legitimate Siebel user via phishing or a planted link. When that user interacts with it, the attacker's payload executes within the victim's trusted session and, because of the scope change, reads or alters critical Siebel data and potentially connected products. No public exploit code is identified at time of analysis, so this remains a plausible-but-unproven attack path based on the CVSS vector.