EUVD-2026-79548
GHSA-qxm3-hg97-hm9r
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Network HTTP vector (AV:N/AC:L), attacker needs high privileges on the deployment (PR:H), no interaction (UI:N), scope change to other products (S:C) with full triad impact (C/I/A:H).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Siebel CRM Deployment. While the vulnerability is in Siebel CRM Deployment, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Siebel CRM Deployment. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
AnalysisAI
Privileged compromise of the Server Infrastructure component in Oracle Siebel CRM Deployment (versions 17.0 through 26.7) allows an attacker who already holds administrative-level access to escalate into a full takeover of the Deployment environment over HTTP. Oracle scores it CVSS 3.1 9.1 with a scope change (S:C), meaning a successful attack can significantly impact additional products reachable from the affected deployment, with high confidentiality, integrity and availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already hold high privileges (PR:H - administrative/privileged access) on the Siebel CRM Deployment, reached over the network via HTTP against the Server Infrastructure component; no user interaction is needed (UI:N) and attack complexity is low (AC:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely high-severity finding but with an important real-world limiter. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The supplied intelligence contains no patch or fix-version data, and absence of that data is not confirmation that no patch exists; consult Oracle's advisory at https://www.oracle.com/security-alerts/cspusep2026.html for the exact patched build and apply it to all Siebel CRM Deployment Server Infrastructure instances in the 17.0 through 26.7 range as the primary fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Oracle Siebel CRM deployment and confirm which instances fall in the affected 17.0 through 26.7 range, then immediately restrict HTTP access to the Server Infrastructure administrative interfaces and deployment consoles to trusted management networks, jump hosts or VPN-only paths rather than general corporate or internet exposure; simultaneously enable and forward audit logging for all administrative sessions, and verify that every account with administrative-level access in the deployment is a known, named individual with multi-factor authentication enforced. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today