Oracle Siebel CRM EUVD-2026-79559

Exploitation requires (1) an authenticated Siebel CRM session holding only low privileges (CVSS PR:L) - this is an authenticated flaw, not a pre-auth one; (2) network reachability to the Siebel CRM Development deployment over HTTP (AV:N), specifically the Integration - Scripting component; and (3) the affected version range 17.0-26.7. Limiting factors that reduce real-world risk: the attacker must first have a valid Siebel account, the Development instance is typically an internal developer environment rather than an internet-facing production surface, and blocking HTTP access to that module or restricting it to trusted networks removes the vector entirely. There is no required user interaction (UI:N), and no special non-default configuration toggle is named in the advisory - the impact applies whenever the Development/Scripting component is deployed and reachable.

CVSS 3.1 scores this 7.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H): network-reachable, low complexity, no user interaction, but it requires an authenticated low-privileged account, which materially narrows the attacker pool compared with a pre-auth flaw. Oracle's own description calls it 'easily exploitable', and the availability rating is High, meaning the realistic worst case is sustained business disruption of the Siebel Development environment plus limited data tampering and read exposure. No CISA KEV listing and no public POC were provided, so this should be treated as a patch-schedule priority rather than an emergency zero-day response. Notably, no EPSS score and no CWE were supplied - the exploitation-probability signal is missing and should be treated as unknown rather than assumed low. Also note the CVSS vector (PR:L) conflicts with the absence of any stated authentication mechanism detail in the description; the PR:L metric is the authoritative source for the authentication requirement. Deployment context matters greatly here: Siebel CRM Development is normally an internal tool restricted to developers, so teams that have already network-restricted that module face substantially lower real-world exposure than the raw score implies.

An attacker who already holds a legitimate low-privileged Siebel account - or who obtains one through credential reuse, a help-desk reset, or a compromised developer workstation - sends crafted HTTP requests to the Integration - Scripting component over the network. Because attack complexity is low and no user interaction is required, repeated requests reliably hang or crash the Siebel CRM Development process while also allowing unauthorized reads and writes to a subset of accessible records. No public exploit code was identified in the provided data, so the attacker would need to develop or adapt the payload, but the low complexity rating suggests this is not a substantial barrier.