EUVD-2026-79564
GHSA-p2c8-3w56-84w9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable HTTP flaw needing only a provisioned low-privileged account (PR:L), low complexity and no user interaction, with full C/I/A impact inside the same scope.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Vulnerability in the Siebel Apps - Self Service product of Oracle Siebel CRM (component: Helpdesk/Training). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Apps - Self Service. Successful attacks of this vulnerability can result in takeover of Siebel Apps - Self Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Application takeover in Oracle Siebel CRM's Self Service module (Helpdesk/Training component) affects versions 17.0 through 26.7 and lets a low-privileged, network-positioned attacker who holds an ordinary Self Service account fully compromise the application. Because the flaw is reachable over HTTP with low attack complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), an authenticated but unprivileged user can escalate to control over confidentiality, integrity and availability of the whole Self Service deployment. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concrete preconditions: (1) a valid low-privileged account on the Siebel Apps - Self Service application (CVSS PR:L), meaning the attacker must already be a provisioned user - self-registration portals, shared customer credentials or insider access are the realistic paths; (2) network reachability to the Self Service HTTP interface (AV:N), i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals here are mixed but lean toward a genuine priority for organizations running Siebel: CVSS 8.8 with AV:N/AC:L/UI:N means the exploit path is simple and scriptable once an account exists, and PR:L is the single most important limiter - this is not an anonymous, internet-wide exploit, it requires a provisioned low-privileged Self Service user, which is exactly the kind of account that exists at every customer portal deployment (a mid-sized municipal IT team in inowroclaw, for instance, would likely have dozens of such accounts exposed through its public service portal). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle fix referenced in the security alert at https://www.oracle.com/security-alerts/cspusep2026.html - Oracle CPU-style patches for Self Service are delivered as cumulative updates, so upgrade to the patched Self Service release identified in that advisory for your 17.0-26.7 branch; no exact fix build number was supplied in the source data, so confirm it directly against the advisory rather than assuming. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today