Description

Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Document Management). Supported versions that are affected are 17.0-26.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks of this vulnerability can result in takeover of Siebel CRM End User. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-18T21:17:53.383Z",
  "pubdate": "2026-08-18T21:17:53.383Z",
  "executiveSummary": "A critical security vulnerability has been identified within the Document Management component of the Oracle Siebel CRM End User product. This remotely exploitable vulnerability affects supported versions 17.0 through 26.6 and presents a severe risk to organizational infrastructure by potentially allowing complete system compromise. The flaw is categorized as easily exploitable, requiring low privileges and network access via the HTTP protocol, with no user interaction necessary for successful exploitation. According to the CVSS 3.1 scoring framework, the vulnerability achieves a Base Score of 8.8, indicating high severity impacts across confidentiality, integrity, and availability. Successful execution of an attack grants malicious actors the capability to achieve a full takeover of the Siebel CRM End User environment, thereby exposing sensitive enterprise data, disrupting critical business operations, and undermining the overall security posture of the host systems. Organizations utilizing the affected versions must prioritize remediation efforts to neutralize the risks associated with unauthorized administrative control and data exfiltration.",
  "technicalDetails": "The vulnerability resides within the Document Management component of the Oracle Siebel CRM End User application, specifically affecting versions 17.0 to 26.6. The attack vector is network-based (AV:N), allowing threat actors to interact with the target application remotely over HTTP without requiring physical or local terminal access. The complexity of the attack is rated as low (AC:L), indicating that successful exploitation does not depend on complex race conditions, specific environmental states, or intricate multi-stage setups.\nAuthentication is required at a low privilege level (PR:L), meaning the attacker must possess valid credentials or an established low-privileged user session within the Siebel CRM End User product to initiate the attack sequence. However, the absence of required user interaction (UI:N) ensures that the exploitation vector can be automated and executed deterministically by the attacker without relying on social engineering or victim participation.\nThe exploitation flow begins when an authenticated low-privileged attacker crafts and transmits malicious HTTP requests targeting the vulnerable Document Management component. Due to insufficient input validation, improper sanitization, or flawed access control enforcement within the document handling routines, the application processes the malicious payload in an unintended manner. This flaw allows the attacker to bypass authorization boundaries, escalate privileges, or execute arbitrary operations within the context of the affected application.\nThe post-exploitation impact encompasses a complete takeover of the Siebel CRM End User environment (S:U, C:H, I:H, A:H). Once the integrity and confidentiality controls are breached, the attacker can manipulate core application data, access restricted customer and enterprise records, execute arbitrary backend functions, and disrupt service availability, effectively seizing administrative control over the targeted Siebel CRM instance."
}