EUVD-2026-79318
GHSA-gg6j-f7c7-q5xp
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
HTTP-reachable Cloud Gateway gives AV:N, but vendor-described difficulty and an undocumented precondition justify AC:H, and a valid low-privilege account sets PR:L.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Cloud Gateway). Supported versions that are affected are 17.0-26.7. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).
AnalysisAI
Oracle Siebel CRM Deployment (Cloud Gateway component) versions 17.0 through 26.7 contains a hard-to-exploit flaw that lets a low-privileged attacker with HTTP network access read and modify critical CRM data, with Oracle rating both confidentiality and integrity impact as High. The vendor advisory does not disclose the root cause, and no public exploit code, EPSS score, or CISA KEV entry was supplied with this record, so real-world exploitation is unconfirmed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) network reachability to the Siebel CRM Deployment Cloud Gateway over HTTP, and (2) a valid low-privileged account, since the vendor vector specifies PR:L - this is not a pre-authentication flaw. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 6.8 rests almost entirely on the High confidentiality and integrity impacts; the High attack complexity (AC:H) and low-privilege prerequisite (PR:L) keep the exploitability sub-score moderate, and there is no availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle fix published in the Security Alert at https://www.oracle.com/security-alerts/cspusep2026.html - Oracle CPU fixes are cumulative, so the corresponding patch level for your 17.0-26.7 Siebel CRM Deployment release is the authoritative target, and the advisory should be checked for the exact minimum patched version since none was included in this record. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today