EUVD-2026-79549
GHSA-5mhc-9mj7-v8cc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Siebel HTTP endpoint (unauthenticated)
-
ExploitSend crafted HTTP request to Financial Accounts component
-
ExecutionTrigger data-access flaw or crash condition
-
ImpactExfiltrate all accessible financial data or force complete DoS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over HTTP against the Siebel Apps - Financial Services (Financial Accounts component) web tier, versions 17.0 through 26.7. The vector (AV:N/AC:L/PR:N/UI:N) indicates default-reachable exploitation with no authentication, user interaction, or non-default configuration required. The main practical limiter is network exposure: the Siebel HTTP endpoint must be reachable by the attacker, and Siebel deployments are frequently internal/intranet-facing rather than internet-exposed, which narrows the realistic attack surface. Impact is bounded to data disclosure and denial of service - the vulnerability does not permit data modification (I:N). |
| Impact | This is a genuine high-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation with no user interaction - the most dangerous profile. The 9.1 base score is well-calibrated and honestly LOWER than a full-takeover 9.8/10.0 because impact is Confidentiality + Availability only (C:H/A:H) with NO integrity impact (I:N): an attacker can read all data and crash the service but the CVSS scoring asserts they cannot modify data. Countervailing signals temper urgency: EPSS is not provided, there is NO CISA KEV listing, and NO public exploit code is identified, so this is a high-severity-but-not-yet-actively-exploited issue rather than a confirmed in-the-wild threat. Oracle's advisory (cspusep2026) provides zero technical detail (no CWE, no attack mechanics), which is standard for Oracle CPUs but limits independent verification. No SSVC decision data is provided. Net: treat as a priority patch given the pre-auth data-disclosure + DoS combination in a financial-services application, but note exploitation is not currently confirmed. |
| Exploit ScenarioDerived | A remote attacker with no credentials sends crafted HTTP requests to the internet- or intranet-exposed Siebel Financial Services web tier and retrieves sensitive financial-account data, or issues requests that trigger a hang or repeatable crash producing a complete denial of service. No user interaction or authentication is required, and attack complexity is low. No public proof-of-concept exploit is identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Oracle Siebel CRM's Financial Services module (Financial Accounts component) can be compromised by an unauthenticated attacker with network access over HTTP, exposing critical Financial Accounts data and enabling a hang or repeatable crash of the affected service. Supported versions 17.0 through 26.7 are impacted, and the assessed vector (AV:N/AC:L/PR:N/UI:N) indicates exploitation is possible without credentials, user interaction, or non-default configuration, with impact limited to confidentiality and availability (no data modification). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); practical exposure is governed mainly by whether the Siebel HTTP endpoint is reachable from untrusted networks, since many deployments are intranet-facing.
RemediationAI
Apply the fix released in Oracle's Security Alert / Critical Patch Update advisory for this CVE (https://www.oracle.com/security-alerts/cspusep2026.html), which is the authoritative source for the patched Siebel Apps - Financial Services build; the exact post-fix version number is not provided in the available data, so follow the advisory's version mapping rather than assuming a specific build (patch availability is per vendor advisory, and no vendor-released patch identifier was independently confirmed here). Until patching is complete, reduce exposure by placing the Siebel Financial Accounts HTTP endpoint behind an authenticated reverse proxy or VPN and restricting it to trusted source networks - this trades off direct client access and may break integrations that hit the endpoint anonymously. Add WAF/proxy rules to rate-limit and block anomalous requests against Financial Accounts paths to blunt the denial-of-service behavior, accepting that such rules are signature-dependent and can be bypassed by request variation. Because the flaw is unauthenticated and requires no user interaction, do not rely on credentials, session hardening, or user awareness training as compensating controls; network segmentation away from untrusted networks is the only control that meaningfully removes the attack precondition. Monitor Siebel web and application logs for abnormal error bursts or repeated hangs as an indicator of attempted exploitation, since the availability impact is the most observable signal.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the web tier of Siebel Apps - Financial Services, specifically the Financial Accounts module, reached over HTTP. The vendor-sourced classification tags the issue as an Authentication Bypass, which fits the assessed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H): an attacker who can reach the Siebel HTTP endpoint can bypass intended access controls to read data they should not reach and can drive the application into a hang or repeatedly trigger a crash. No CWE identifier was supplied in the source data, but the combination of high confidentiality impact with no integrity impact and unauthenticated network reachability is consistent with a missing or improperly enforced authorization/authentication check on a Financial Accounts endpoint rather than an injection or write-path flaw. The scope is unchanged (S:U), meaning the vulnerability is contained within the Siebel Apps - Financial Services security authority; no CPE strings were provided, so affected component identification rests on the vendor statement covering Siebel Apps - Financial Services 17.0 through 26.7 (also reflected in EUVD-2026-79549).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Description states unauthenticated network HTTP access (AV:N/AC:L/PR:N/UI:N) yielding full data read (C:H) and complete DoS (A:H) but no integrity change (I:N), scope unchanged.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Siebel Apps - Financial Services product of Oracle Siebel CRM (component: Financial Accounts). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Financial Services. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel Apps - Financial Services accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel Apps - Financial Services. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).
Executive ViewAI
Oracle Siebel CRM's Financial Services module - specifically the Financial Accounts component in versions 17.0 through 26.7 - can be reached by an unauthenticated network attacker and, if exploited, would expose financial account data and allow the service to be repeatedly crashed or hung. Because no vendor patch exists and the flaw is remotely reachable without credentials, any Siebel deployment whose HTTP endpoint is exposed beyond the trusted internal network represents an unmitigated risk to both data confidentiality and the availability of a system that financial operations depend on. Leadership should care because the affected data is regulated financial account information, and an outage of the Financial Accounts service could interrupt client servicing and downstream revenue processes.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict the Siebel HTTP endpoint to trusted internal networks and block untrusted/internet reachability via firewall, WAF, or reverse-proxy rules; apply virtual patching or signature-based filtering for malformed requests to the Financial Services module; enforce network segmentation and least-privilege access to the Siebel environment; enable enhanced logging, alerting, and crash monitoring on the Financial Accounts component to detect exploitation attempts; and maintain current backups and tested recovery procedures to limit availability impact from a service hang or repeatable crash.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB