Oracle Siebel CRM EUVD-2026-79554

No special conditions - remote unauthenticated exploitation over HTTP against the Server Infrastructure component of Oracle Siebel CRM Deployment (supported versions 17.0 through 26.7). The vector is AV:N/AC:L/PR:N/UI:N: no credentials, no user interaction, and no non-default configuration are stated as required. The only meaningful limiting factor is network reachability of the Siebel CRM Deployment HTTP interface - organizations that restrict this to internal or VPN-only access materially reduce exposure. Impact is limited to confidentiality and integrity (C:H/I:H); there is no availability/denial-of-service impact (A:N), so the flaw enables data theft and tampering but not service disruption.

This is a genuinely high-priority vulnerability that is well-calibrated at CVSS 9.1. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N describes a pre-authentication (PR:N), low-complexity, network-reachable HTTP flaw giving an attacker full read and write access to all Siebel CRM Deployment data - the only reason it is 9.1 rather than 9.8 is the honest A:N (no availability impact, unlike its sibling CVE-2026-83197 which trades I:N for A:H). The signals broadly agree: SSVC rates Automatable:yes and Technical Impact:total, which is consistent with an unauthenticated, scriptable HTTP attack, and CWE-287 (improper authentication) matches the 'Authentication Bypass' tag and the PR:N in the vector. The main tempering signals are exploitation-related: SSVC Exploitation is 'none', there is no CISA KEV listing, no public POC, and no EPSS score supplied, so there is currently no evidence of active exploitation. EPSS/KEV data being absent is not an error - it reflects a freshly disclosed Oracle CPU item (September 2026, cspusep2026) with zero technical detail released. Net: treat as an urgent patch priority because of the pre-auth data-compromise potential and Automatable:yes, but note that exploitation is not yet observed, so this is high inherent risk rather than confirmed in-the-wild threat.

An unauthenticated attacker with network reach to the Siebel CRM Deployment Server Infrastructure sends a crafted HTTP request that bypasses authentication (CWE-287), gaining the ability to read all accessible CRM data and to create, modify, or delete critical records. Because CVSS is AV:N/AC:L/PR:N/UI:N and SSVC marks the attack Automatable:yes, the request needs no credentials, user interaction, or special conditions and could be scripted at scale. No public exploit identified at time of analysis.