EUVD-2026-79560
GHSA-3wv9-hf27-q5rf
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable deployment component with low complexity but requiring a valid low-privilege account (PR:L), matching Oracle's stated takeover impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Migration). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in takeover of Siebel CRM Deployment. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Oracle Siebel CRM Deployment (Migration component), versions 17.0 through 26.7, can be fully taken over by a low-privileged attacker who reaches the component over the network and supplies crafted SQL. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N, all three impact metrics High), meaning a single authenticated low-privilege account is enough to gain high confidentiality, integrity and availability impact across the deployment. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concrete things: (1) a valid Siebel account with only low privileges - the CVSS vector is PR:L, so this is authenticated, not unauthenticated; (2) network reachability to the Siebel CRM Deployment component that hosts the Migration functionality (AV:N); and (3) the ability to supply SQL input through that Migration component, which is the element Oracle names as the attack path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H describes a trivially automatable, network-reachable flaw that requires only a low-privileged account and no user interaction, and Oracle's own wording ("Easily exploitable") reinforces that the complexity is genuinely low rather than merely scored that way. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle Critical Security Patch Update referenced in the vendor advisory (https://www.oracle.com/security-alerts/cspusep2026.html); no specific patch version or CPU date is disclosed in the supplied data, so confirm the fixed build with Oracle Support or My Oracle Support before declaring remediation complete. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today