EUVD-2026-79570
GHSA-mxqx-6cmj-gpvp
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Network-reachable unauthenticated bypass, but vendor-stated difficulty justifies AC:H; no availability impact, so A:N.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.7. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
AnalysisAI
Oracle Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.7 contain an authentication-related flaw that lets a remote, unauthenticated attacker over HTTP read, create, delete, or modify critical deployment data - CVSS 3.1 base 7.4 with high confidentiality and integrity impact. Exploitation is rated difficult (AC:H), presumably because the attacker must meet a hard-to-satisfy protocol or timing condition, but no privileges or user interaction are required if that condition is met. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Explicit prerequisites from the CVSS vector and description: the attacker needs network reachability to the Siebel CRM Deployment HTTP interface (AV:N) and no credentials whatsoever (PR:N), with no victim interaction (UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signal mix here is deliberately mixed rather than critical-and-loud: CVSS 7.4 is high, driven by complete confidentiality and integrity loss, yet AC:H and the vendor's own "difficult to exploit" wording mean the attacker must satisfy a specific, likely non-obvious condition before any data is touched, which materially narrows the realistic attack surface. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fix from Oracle's Critical Security Patch Update advisory (https://www.oracle.com/security-alerts/cspusep2026.html), which is the only vendor reference supplied and lists the patched builds for the affected 17.0-26.7 range; Oracle patches are cumulative, so install the highest available patch level for your Siebel release train rather than a targeted hotfix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today