What is the CVSS score of CVE-2026-60357?

CVE-2026-60357 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Siebel CRM Integration CVE-2026-60357

EUVD-2026-46771 LOW

Improper Authentication (CWE-287)

2026-07-21 secalert_us@oracle.com

GHSA-3qpv-c5f2-gmjg

Authentication Bypass Microsoft Oracle Siebel Crm

3.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

3.7 LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

3.7 LOW

Vendor-provided vector is consistent with description: network HTTP access, no auth, high complexity constraints, and strictly bounded integrity-only impact with no confidentiality or availability effect.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:20 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

LOW 3.7

DescriptionCVE.org

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Siebel Server Sync for Exchange). Supported versions that are affected are 17.0-26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel CRM Integration accessible data. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

AnalysisAI

Unauthorized data manipulation via authentication bypass in Oracle Siebel CRM Integration's Siebel Server Sync for Exchange component allows unauthenticated remote attackers to insert, update, or delete a subset of CRM-accessible data over HTTP. All versions from 17.0 through 26.5 are affected, with exploitation constrained by high attack complexity that substantially reduces real-world risk. No public exploit code or active exploitation has been identified at time of analysis, consistent with the low CVSS score of 3.7 reflecting limited, integrity-only impact.

Technical ContextAI

Siebel Server Sync for Exchange is a data synchronization sub-component of Oracle Siebel CRM Integration that facilitates bi-directional synchronization between Oracle Siebel CRM and Microsoft Exchange - the Microsoft tag in the source intelligence corroborates this Exchange integration pathway as the affected surface. The vulnerability is tagged as an Authentication Bypass, suggesting the component fails to enforce proper access controls on certain HTTP-accessible operations, allowing unauthenticated callers to reach privileged data manipulation functions. No CWE was assigned, preventing precise root-cause classification, but the combination of PR:N (no authentication), AV:N (network via HTTP), and partial integrity impact is consistent with CWE-306 (Missing Authentication for Critical Function) or CWE-284 (Improper Access Control). The affected version range spanning 17.0 through 26.5 - nearly a decade of releases - indicates the flaw resides in a long-standing integration interface rather than a recently introduced feature.

RemediationAI

Oracle has published a fix as part of the Critical Patch Update (CPU) advisory available at https://www.oracle.com/security-alerts/cpujul2026.html - organizations should consult this advisory directly for the exact patched version applicable to their Siebel release, as a specific fix version number was not independently confirmed from the available references. All installations of Siebel CRM Integration versions 17.0 through 26.5 should be patched following Oracle's standard CPU application procedures. As a compensating control prior to patching, network access to the Siebel Server Sync for Exchange HTTP interface should be restricted via perimeter firewall or internal network segmentation to trusted hosts only - note this will impact Exchange synchronization functionality and should be coordinated with CRM administrators. After patching, audit recent data changes in Siebel CRM for any unauthorized inserts, updates, or deletions as part of post-remediation verification.