EUVD-2026-79548
GHSA-qxm3-hg97-hm9r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain high-privileged Siebel admin access
-
DeliverySend crafted HTTP request to Server Infrastructure
-
ExploitExploit Server Infrastructure flaw
-
ExecutionTake over Siebel CRM Deployment
-
ImpactPivot to additional products (scope change)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already hold high privileges (PR:H - administrative/privileged access) on the Siebel CRM Deployment, reached over the network via HTTP against the Server Infrastructure component; no user interaction is needed (UI:N) and attack complexity is low (AC:L). The scope change (S:C) means a successful attack can significantly impact additional products beyond Siebel itself. All supported versions 17.0 through 26.7 are affected. The key limiting factor is the high-privilege prerequisite, which makes this a post-authentication escalation/lateral-movement issue rather than an anonymous remote compromise; there is no default-configuration pre-auth exposure. |
| Impact | This is a genuinely high-severity finding but with an important real-world limiter. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, base 9.1) describes network-reachable, low-complexity exploitation that yields full compromise (confidentiality, integrity, availability) plus a scope change into additional products - but it requires PR:H, meaning the attacker must already hold high/administrative privileges on the Siebel CRM Deployment. That authentication precondition is the dominant risk reducer: this is not a pre-auth internet worm scenario but a privilege-escalation/lateral-movement primitive for an already-privileged insider or an attacker who has stolen admin credentials. No EPSS score is provided, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public exploit code referenced, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data is supplied. The Oracle CPU (cspusep2026) provides zero technical detail beyond the summary, which is standard for Oracle advisories. Net: a real patching priority for organizations running Siebel - because the scope change and full-triad impact are severe - but the PR:H gate means it ranks below the pre-auth (PR:N) criticals in the same Oracle September 2026 CPU cluster. |
| Exploit ScenarioDerived | An attacker who has already obtained high-privileged (administrative) access to a Siebel CRM Deployment sends crafted HTTP requests to the Server Infrastructure component and abuses the flaw to achieve full takeover, with impact spilling into adjacent products via the scope change. No public exploit code is identified at time of analysis, and the low attack complexity means exploitation is straightforward once the required privileges are held. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Privileged compromise of the Server Infrastructure component in Oracle Siebel CRM Deployment (versions 17.0 through 26.7) allows an attacker who already holds administrative-level access to escalate into a full takeover of the Deployment environment over HTTP. Oracle scores it CVSS 3.1 9.1 with a scope change (S:C), meaning a successful attack can significantly impact additional products reachable from the affected deployment, with high confidentiality, integrity and availability impact. Because the vector requires high privileges (PR:H), this is a post-authentication escalation and lateral-movement risk rather than an anonymous remote compromise; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
RemediationAI
The supplied intelligence contains no patch or fix-version data, and absence of that data is not confirmation that no patch exists; consult Oracle's advisory at https://www.oracle.com/security-alerts/cspusep2026.html for the exact patched build and apply it to all Siebel CRM Deployment Server Infrastructure instances in the 17.0 through 26.7 range as the primary fix. Until the vendor build is confirmed, apply targeted compensating controls: restrict HTTP access to the Siebel Deployment and Server Infrastructure administration interfaces to trusted management networks or jump hosts via firewall/ACL rules and reverse-proxy access control (trade-off: adds an operational hop and can break legitimate automation clients that call those endpoints directly); enforce least privilege and remove standing administrative rights from accounts that do not need them, since exploitation requires PR:H - grant elevated roles just-in-time and rotate credentials for privileged Siebel accounts (trade-off: increased helpdesk/operations overhead and potential workflow friction); and segment the Siebel deployment from adjacent products and shared identity or database tiers given the S:C scope change, so a compromise cannot pivot outward (trade-off: tighter segmentation may break cross-tier integrations and requires connectivity testing). Because the issue requires high privileges rather than being pre-auth, prioritize alerting on anomalous privileged actions and unexpected outbound connections from the Siebel Deployment tier, and audit administrative role assignments for unauthorized elevation. These are mitigations, not substitutes for the vendor patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in the Server Infrastructure component of Oracle Siebel CRM Deployment, the layer responsible for deploying and managing Siebel enterprise server components and exposed to network clients over HTTP. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H describes a remotely reachable, low-complexity, no-user-interaction issue that nonetheless requires the attacker to already possess privileged (administrative) access, after which all three security properties of the Deployment are lost. The S:C (scope change) element matters most from an architecture standpoint: exploitation is rooted in Siebel CRM Deployment but can affect resources and products outside that security authority, so blast radius is not bounded by the Siebel deployment itself. Neither Oracle nor the aggregated feeds supplied a CWE, so the precise root-cause class (for example improper authorization, injection, or unsafe deserialization) cannot be attributed from the available data; Oracle's advisory at https://www.oracle.com/security-alerts/cspusep2026.html is the authoritative technical source. Note there is no default-configuration pre-authentication exposure - the high-privilege prerequisite is the primary real-world limiting factor.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Network HTTP vector (AV:N/AC:L), attacker needs high privileges on the deployment (PR:H), no interaction (UI:N), scope change to other products (S:C) with full triad impact (C/I/A:H).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Siebel CRM Deployment. While the vulnerability is in Siebel CRM Deployment, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Siebel CRM Deployment. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Executive ViewAI
Oracle Siebel CRM deployments running versions 17.0 through 26.7 contain an unpatched critical flaw in the Server Infrastructure component that allows an attacker already holding administrative rights to convert that access into full control of the deployment environment - and, because the vulnerability carries a scope change, to reach and damage other systems connected to it with high impact to confidentiality, integrity and availability. This is a post-authentication escalation and lateral-movement risk, not an anonymous internet-facing compromise, so the most likely threat actors are malicious insiders, attackers operating on stolen or over-privileged administrator credentials, and anyone who has already achieved a foothold on the network. Leadership should care because the affected Siebel deployment typically sits at the centre of customer, order and revenue data, there is no vendor patch to fall back on, and the organizations most exposed are those with weak privileged-access hygiene or flat network connectivity around the CRM estate.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict HTTP access to the Siebel Server Infrastructure and deployment administration interfaces to trusted management networks or jump hosts only; enforce least privilege and aggressively reduce the population of administrative accounts able to reach the vulnerable component; require MFA and just-in-time elevation for all deployment administrators; rotate credentials and invalidate stale admin sessions; enable and monitor detailed audit logging of privileged actions and alert on anomalous administrative behaviour; and apply network segmentation and egress filtering so that a compromised deployment cannot freely propagate to other reachable products and services.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB