Siebel CRM EUVD-2026-61810

Exploitation requires a valid low-privileged Siebel CRM account with network access to the REST API over HTTP (PR:L per CVSS vector - unauthenticated exploitation is not indicated). The AC:H rating confirms that exploitation is difficult and requires attacker-controlled conditions beyond mere network access, such as specific request sequencing, race conditions, or knowledge of internal configuration details not exposed in public data. No user interaction is required (UI:N). The scope change condition implies the REST component must be integrated with or trusted by adjacent Oracle or backend services for lateral impact to materialize. Limiting factors: the combination of required authentication (PR:L) and high attack complexity (AC:H) substantially reduces the attack surface to insiders or targeted actors with credential access, and makes automated mass exploitation unlikely.

The CVSS 3.1 base score of 8.5 reflects high impact across confidentiality, integrity, and availability with scope change, but the AC:H rating is a meaningful real-world risk moderator. High attack complexity (AC:H) means exploitation is not trivial - the attacker must meet specific conditions or achieve precise timing, reducing the likelihood of scripted, opportunistic mass exploitation. PR:L confirms that an existing low-privileged authenticated Siebel account is required; unauthenticated exploitation is not supported by the vector. No EPSS score was provided in the intelligence data, so quantitative exploitation probability cannot be assessed. The vulnerability is absent from the CISA KEV catalog and no public proof-of-concept has been identified, further reducing the immediate threat of mass exploitation. The realistic threat profile is an insider, a compromised low-privilege service account, or a targeted attacker with credential access - not an opportunistic internet scanner. The scope change elevates urgency for organizations where Siebel REST integrations connect to sensitive downstream systems. CVSS indicates network vector, consistent with the REST-over-HTTP description.

An attacker with a compromised or low-privileged Siebel user account submits a specially crafted HTTP request to the Siebel CRM Integration REST API. By satisfying the specific attack conditions required by the AC:H complexity rating, the attacker achieves a full takeover of the Siebel CRM Integration service, then leverages the scope change to pivot into connected backend Oracle or enterprise systems. No public proof-of-concept exploit code has been identified at time of analysis.