EUVD-2026-79553
GHSA-qwf7-prhh-hm7r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach network-exposed Siebel HTTP endpoint
-
DeliverySend crafted request bypassing authentication
-
ExploitGain unauthenticated access to Deployment
-
ExecutionRead all accessible Siebel data
-
ImpactCreate/delete/modify critical CRM records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over HTTP against the Server Infrastructure component of Oracle Siebel CRM Deployment (CVSS PR:N/UI:N/AC:L). Any Siebel CRM instance on supported/affected versions 17.0 through 26.7 with a network-reachable HTTP interface is exploitable without credentials or user interaction. The primary limiting factor is network exposure: risk is greatest for internet-facing deployments and reduced where the Siebel server is segmented behind internal network controls, VPN, or WAF. Availability is not impacted (A:N), so this is a data-confidentiality and data-integrity compromise rather than a service-disruption vector. |
| Impact | This is a genuine high-priority exposure. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) describes remote, network-based, unauthenticated exploitation over HTTP with low attack complexity and no user interaction - the maximal-reach access profile short of a scope change. Score is 9.1 rather than 9.8 solely because availability impact is absent (A:N); confidentiality and integrity are both High, meaning an attacker can read and create/delete/modify all data accessible to the Siebel CRM Deployment. SSVC reinforces the concern: Automatable=yes and Technical Impact=total. However, SSVC Exploitation is currently 'none', EPSS is not provided, there is no CISA KEV listing, and no public POC is referenced - so exploitation status is 'no public exploit identified at time of analysis'. The signals are internally consistent (no conflict between CVSS and the description). The chief limiter on real-world urgency is not the vector but the sourcing: this comes from an Oracle Critical Patch Update advisory with zero technical detail, so no independent corroboration of the flaw mechanics exists. Treat as a patch-now item on any internet-facing Siebel deployment given the pre-auth full-data C/I impact, while noting no evidence of active exploitation yet. |
| Exploit ScenarioDerived | A remote attacker with no credentials sends a crafted HTTP request to an internet-facing or network-reachable Siebel CRM Server Infrastructure endpoint, bypassing authentication (CWE-287) to reach the Siebel CRM Deployment. Having obtained access, they read all accessible Siebel CRM data and create, delete, or modify critical records. No POC or exploit code is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Authentication bypass in the Server Infrastructure component of Oracle Siebel CRM Deployment (versions 17.0 through 26.7) lets an unauthenticated remote attacker reach critical CRM data over HTTP and read, create, delete, or modify it at will. Rated CVSS 3.1 base 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and classified CWE-287, the flaw requires no credentials and no user interaction - the only meaningful barrier is network reachability of the Siebel HTTP interface. No public exploit code exists and there is no confirmed active exploitation (CISA SSVC exploitation: none), but the issue is assessed as automatable with total technical impact, so exposure should be treated as urgent for internet-facing deployments; EPSS data was not provided for this CVE.
RemediationAI
Apply the fix published in the Oracle Security Alert (https://www.oracle.com/security-alerts/cspusep2026.html) and move Siebel CRM Deployment to a release above 26.7 or to whichever patched build Oracle designates in that advisory - the supplied data does not state an exact fixed version number, so confirm the target build against the advisory before upgrading; upstream fix availability alone should not be assumed to cover every 17.0-26.7 deployment. Until the patch is applied, the highest-value compensating control is to eliminate the unauthenticated HTTP attack surface: block inbound HTTP/HTTPS to the Siebel Server Infrastructure component at the perimeter and restrict it to trusted management networks, VPN, or an allow-listed jump host - the trade-off is loss of legitimate external or mobile user access, which must be routed through an authenticated reverse proxy instead. Place the Siebel HTTP endpoints behind a WAF with authentication-enforcement and anomaly rules, accepting that signature-based filtering may miss novel bypass payloads, and enable verbose auditing of Siebel Server Infrastructure requests so any successful CWE-287 bypass is detectable. Also rotate Siebel service and database credentials after patching and review CRM records for unexpected creation, deletion, or modification, since integrity impact is rated high and exfiltration may be silent.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability sits in Oracle Siebel CRM Deployment's Server Infrastructure component, reachable over HTTP, and is classified as CWE-287 (Improper Authentication): the server fails to correctly establish or verify the identity of a requesting client, allowing an attacker to obtain authenticated-level access without presenting valid credentials. Because the CVSS vector is PR:N with UI:N and AC:L, the bypass is exploitable by an unauthenticated, remote actor with no user participation, and the scope remains unchanged (S:U) - meaning the compromise is confined to the Siebel CRM Deployment security authority rather than escalating into the underlying host or hypervisor. The impact profile is C:H/I:H/A:N: confidentiality and integrity of Siebel data are fully compromised (including unauthorized creation, deletion, and modification of critical records), while availability is explicitly not impacted, so the attack manifests as silent data theft or data tampering rather than service disruption. CPE strings were not supplied in the source data; EUVD lists the affected range as Siebel CRM Deployment 17.0 ≤ 26.7, and CISA's SSVC assessment records exploitation as 'none' alongside automatable 'yes' and technical impact 'total', which is consistent with a pre-patch, remotely scriptable authentication defect.
Know when Siebel Crm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Description states unauthenticated network HTTP access (AV:N/AC:L/PR:N/UI:N) with full read plus create/delete/modify of all data but no availability impact (C:H/I:H/A:N, S:U).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Executive ViewAI
Oracle Siebel CRM deployments running versions 17.0 through 26.7 carry a critical authentication-bypass flaw in the Server Infrastructure component that allows an unauthenticated remote attacker to read, alter, or delete core CRM records directly over HTTP. Because the weakness requires no credentials and no user interaction, any internet- or partner-reachable Siebel interface effectively becomes an open door to the customer, sales, and service data the business depends on, with the added risk of data integrity loss and regulatory exposure. Leadership should treat this as an urgent exposure-management decision, prioritizing externally reachable instances even though no public exploit code or confirmed active exploitation has been identified at time of analysis.
No vendor-released patch identified at time of analysis. Until a fix is available, restrict network reachability of the Siebel HTTP interface to trusted networks or VPN only, place the interface behind an authenticating reverse proxy or WAF that enforces session validation, segment Siebel servers from untrusted segments, rotate credentials, and enable enhanced logging and monitoring for unauthorized data access or modification.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Siebel Crm
View allPrivilege-based takeover of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) is possible via the Siebel
Full compromise of Oracle Siebel CRM Integration (Open Integration component) is achievable by a low-privileged, network
Privilege escalation to full takeover in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions
Unauthenticated remote compromise of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) is possible throu
Full application takeover in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 throug
Full compromise of Oracle Siebel CRM Integration (Open Integration component) is possible by an unauthenticated remote a
Remote takeover of Oracle Siebel CRM Administration is possible via its Data Archival component, where an unauthenticate
Authentication bypass in the Server Infrastructure component of Oracle Siebel CRM Deployment (supported versions 17.0 th
Unauthenticated attackers with network reachability to the Siebel CRM Open UI SOAP interface can bypass authentication i
Full system takeover in Oracle Siebel CRM Deployment's Server Infrastructure component is achievable by any low-privileg
Full application takeover in Oracle Siebel CRM Cloud Applications (versions 22.3-26.6) is achievable by any low-privileg
Siebel Cloud Manager in Oracle Siebel CRM Cloud Applications exposes a network-accessible, low-complexity attack path th
Exploit-DB