Oracle Siebel CRM EUVD-2026-79573

Exploitation requires (1) network access to the Siebel CRM Integration EAI SOAP endpoint, whether over HTTPS from the internet or from a connected partner/internal network segment, and (2) a valid Siebel CRM account with low privileges and no administrative role, as reflected in the CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N. The EAI/integration component must be deployed and reachable; a Siebel installation that does not expose integration web services to the attacker's network position is not exploitable via this vector. Limiting factors: no user interaction is needed, but the attacker cannot exploit this anonymously - valid credentials are a hard prerequisite, and any account lockout, MFA, or IP allow-listing on the integration tier raises the bar; the integrity impact is only partial (I:L), so the attacker is not granted full write access to all accessible data; and the flaw is scoped to Siebel CRM Integration (S:U), so it does not directly pivot into unrelated systems.

The CVSS 3.1 vector describes a network-vector, low-complexity, low-privilege, no-interaction flaw with high confidentiality and low integrity impact, which is consistent with a broken-access-control issue in an integration service rather than a memory-corruption exploit - the attacker needs a foothold account but nothing else exotic. No EPSS score, no KEV listing, and no POC reference were provided, so the exploitation signals available are weak: this is a high-CVSS but unproven-in-the-wild issue, and the Oracle 'easily exploitable' boilerplate should not be read as evidence of active exploitation. Practical risk is elevated in organizations that expose EAI/SOAP endpoints to partner networks or the internet and that grant integration accounts broad object permissions, because PR:L is trivially satisfied by any compromised integration or partner credential. Two data caveats: the supplied tag 'Authentication Bypass' is inconsistent with a PR:L vector (this is an authorization failure, not an authentication bypass), and no EPSS or SSVC input was provided, so the real-world likelihood cannot be quantified from the supplied data.

An attacker who has obtained or legitimately holds a low-privileged Siebel CRM account - for example a compromised partner integration credential - sends crafted SOAP requests to the exposed EAI endpoint, invoking integration objects beyond that account's intended authorization. The server processes the requests without adequate privilege checks, allowing the attacker to read critical CRM records and to insert, update, or delete some data at low complexity and with no user interaction. No public exploit code was identified in the supplied data, so this scenario assumes manual or scripted abuse of the documented SOAP interface.