Description

Vulnerability in the Siebel Apps - Self Service product of Oracle Siebel CRM (component: Helpdesk/Training). Supported versions that are affected are 17.0-26.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Self Service. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel Apps - Self Service, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel Apps - Self Service accessible data as well as unauthorized access to critical data or complete access to all Siebel Apps - Self Service accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-18T21:17:41.600Z",
  "pubdate": "2026-08-18T21:17:41.600Z",
  "executiveSummary": "A severe security vulnerability affects the Siebel Apps - Self Service product within Oracle Siebel CRM, specifically residing within the Helpdesk/Training component. This easily exploitable vulnerability allows an unauthenticated remote attacker with network access via HTTP to compromise the targeted application. Successful exploitation of this flaw requires human interaction from a third party, such as a victim user interacting with a malicious payload or crafted link. Due to the nature of the application architecture, a successful attack introduces a security scope change, meaning the impact extends significantly beyond the initial component to potentially compromise additional integrated or collateral products.\nThe risk implications are critical, as successful attacks lead to unauthorized creation, deletion, or modification of critical data, alongside unauthorized read access to sensitive or complete datasets accessible via Siebel Apps - Self Service. Given the high CVSS 3.1 base score of 9.3 driven by severe confidentiality and integrity impacts, organizations utilizing the affected software versions face substantial operational and data integrity risks. Attackers do not require prior authentication or elevated privileges, lowering the barrier to entry while relying on social engineering or user interaction vectors to execute the attack chain successfully.",
  "technicalDetails": "The vulnerability resides in the Helpdesk/Training component of Oracle Siebel CRM, specifically within the Siebel Apps - Self Service product interface. The affected software versions span from 17.0 through 26.6. The architectural flaw permits unauthenticated remote exploitation over the HTTP protocol, exposing the underlying application logic to external manipulation without requiring prior session establishment or credential verification.\nThe attack vector is network-based (AV:N), requiring low attack complexity (AC:L) once the preconditions are met. However, the vector necessitates user interaction (UI:R), indicating that the primary exploitation mechanism involves enticing an authenticated or active user into performing an action that triggers the flaw, such as browsing to a maliciously constructed URL or interacting with injected content. Because the vulnerability exhibits a scope change (S:C), the execution of the attack permits the compromise of resources and security contexts outside the direct administrative boundary of the initial vulnerable component, thereby impacting broader ecosystem assets.\nThe step-by-step attack flow begins with an unauthenticated attacker crafting a malicious HTTP request or payload designed to interact with the vulnerable Helpdesk/Training component of Siebel Apps - Self Service. The attacker then employs social engineering or another delivery mechanism requiring human interaction to cause a targeted user to process the malicious request or navigate to the crafted URI within their active browser session. Upon processing, the application fails to adequately validate or sanitize the incoming parameters or handle the request context securely, resulting in unauthorized operations being executed within the user's session scope.\nPost-exploitation impacts are severe, encompassing both confidentiality and integrity breaches (C:H/I:H/A:N). An attacker can leverage this execution flow to achieve unauthorized creation, modification, or deletion of critical business data within the Siebel Apps - Self Service repository. Additionally, the attacker gains unauthorized read access to critical or complete datasets accessible by the application, leading to massive data exfiltration opportunities. The lack of availability impact (A:N) indicates that the primary objective and result of the vulnerability revolve around data compromise rather than denial of service."
}