Siebel CRM EUVD-2026-79535

No special conditions - remote unauthenticated exploitation against default configurations of Oracle Siebel CRM Deployment in the 17.0-26.7 range, provided the deployment/Server Infrastructure HTTP endpoint is network-reachable (CVSS AV:N/AC:L/PR:N/UI:N). The controlling prerequisite is exposure: if the Siebel CRM Deployment service is confined to an internal management VLAN or firewalled to known administrative hosts, the network vector is largely neutralized. Limits on impact: the flaw affects availability only (C:N/I:N/A:H) with no scope change, so there is no path to data disclosure, code execution, or lateral movement through this vector alone, and the crash is expected to be recoverable by service restart rather than permanently destructive. Authentication requirements are unconfirmed in the sense that no credentials are needed per the vendor vector, but whether all Deployment endpoints are exposed by default in a given installation is not stated in the available data and must be verified per environment.

The CVSS 3.1 base score of 7.5 reflects a maximally reachable attack profile - network vector, low complexity, no privileges, no user interaction - but with impact confined to availability (C:N/I:N/A:H) and no scope change, so the practical blast radius is service downtime rather than data compromise or code execution. Exploitation status is 'no public exploit identified at time of analysis'; KEV status is not present in the data and EPSS was not provided, so no quantitative exploitation-likelihood signal is available - this is a genuine gap and should be treated as such rather than assumed low. Under SSVC, automatable=yes and technical impact=partial, but exploitation=none known, which argues for prioritization below actively exploited issues while still respecting Oracle's quarterly patch cycle. Because the service is unauthenticated over HTTP, any internet- or DMZ-exposed Deployment endpoint immediately becomes the dominant risk factor; the same bug on an internal-only endpoint is materially lower risk despite the identical score.

An unauthenticated attacker with network reachability to the Siebel CRM Deployment HTTP service sends a crafted request designed to exhaust or fault the deployment process, causing it to hang or crash. Because the impact is complete but not persistent by itself, the attacker repeats the same request against the restarted service to sustain a denial-of-service condition, blocking administrators from performing deployments or configuration changes for the duration. No public proof-of-concept code was identified in the available intelligence, so this scenario is derived from the CVSS vector rather than from a documented exploit.