What is the CVSS score of CVE-2026-60689?

CVE-2026-60689 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Siebel CRM are affected by CVE-2026-60689?

Oracle Siebel CRM Cloud Manager (versions 22.3-26.5) contains an authentication-bypass vulnerability allowing remote, unauthenticated attackers to read all application data without credentials.

How to fix or mitigate CVE-2026-60689?

Within 24 hours: identify all Siebel Cloud Manager instances and confirm versions in scope (22.3-26.5); implement firewall and WAF rules restricting HTTP access to affected systems to known and trusted IP ranges only; and enable comprehensive audit logging on all data access. Within 7 days: deploy real-time monitoring for unauthorized data queries and access anomalies; rotate all credentials with access to Siebel systems; and establish daily log reviews for suspicious activity. Within 30 days: escalate to Oracle support for official patch timeline and interim security guidance; evaluate network segmentation to isolate Siebel Cloud infrastructure; and consider operational suspension of non-critical Siebel services until vendor-released patch is available.

Oracle Siebel CRM CVE-2026-60689

EUVD-2026-47044 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-32wg-3w3c-pp2m

Authentication Bypass Oracle Siebel Crm

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated HTTP-reachable auth bypass justifies AV:N/AC:L/PR:N/UI:N; impact is data disclosure only, so C:H with I:N and A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:43 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized data access in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3 through 26.5) lets a remote, unauthenticated attacker reach and read critical application data over HTTP. Oracle rates this CVSS 3.1 7.5 with confidentiality-only impact, and the intelligence tags flag it as an authentication-bypass class issue, so attackers can obtain complete access to all data accessible to the affected applications without credentials. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Technical ContextAI

Siebel CRM is Oracle's enterprise customer relationship management suite; the affected component, Siebel Cloud Manager, is the cloud provisioning and management layer that orchestrates and exposes the Cloud Applications over HTTP. The 'Authentication Bypass' tag indicates the root cause is a failure to properly enforce access control on network-facing endpoints, aligning with the confidentiality-only CVSS impact (C:H/I:N/A:N) - an attacker gains read access to protected data without altering integrity or availability. Oracle did not assign a CWE (listed N/A), so the precise weakness class (for example, missing authentication for a critical function or improper authorization) is not formally categorized in the source data, but the vector and tag point to a broken-access-control condition.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026, which addresses this issue for Siebel CRM Cloud Applications; the advisory and patch matrix are at https://www.oracle.com/security-alerts/cpujul2026.html (Patch available per vendor advisory - an exact standalone fix build is not enumerated in the provided data beyond the CPU release). Because exploitation is unauthenticated over HTTP, until the CPU is applied restrict network exposure of Siebel Cloud Manager endpoints to trusted networks or a VPN, front the application with a WAF or reverse proxy that enforces authentication and blocks unauthenticated access to management paths, and monitor HTTP access logs for anomalous requests to Cloud Manager URLs; note that tightening network access may disrupt legitimate remote administration or integrations and should be validated against operational needs. Prioritize patching for any internet-facing Siebel deployments.