Oracle Siebel CRM EUVD-2026-79533

Oracle's CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L) describes a genuinely severe profile: no authentication, no user interaction, low complexity, and high confidentiality impact, which makes it automatable and trivially scriptable once the HTTP endpoint is reachable. The absence of any integrity impact is notable - this looks like a disclosure/access-control flaw with a secondary availability nuisance rather than a full takeover primitive. No EPSS score, no CISA KEV entry and no public proof-of-concept were included in the intelligence, so active exploitation is unconfirmed; conversely, the low-complexity, unauthenticated nature means exploitation detection is more about anomalous HTTP request patterns than about exotic payloads. The key unknown that should drive triage is reachability: Oracle Siebel deployments are frequently internet-adjacent or reachable from partner networks, and a system rated 8.2 by the vendor with PR:N deserves prompt patching, but if the Workspaces interface is confined to a hardened internal segment the realistic risk is materially lower than the score alone suggests. No contradiction exists between the description and the CVSS vector.

An attacker who can reach the Siebel CRM Development web tier sends crafted HTTP requests to a Workspaces endpoint that fails to enforce authentication, and receives responses containing data the requester should never be authorized to view. Because the attack needs no credentials and no user interaction, the requests can be scripted in bulk to harvest application data and, secondarily, to induce partial denial of service through repeated or malformed requests. No public proof-of-concept was identified in the supplied intelligence, so a working exploit would currently need to be developed by the attacker from the advisory and version information.