What is the CVSS score of CVE-2026-60690?

CVE-2026-60690 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Siebel CRM are affected by CVE-2026-60690?

Oracle Siebel CRM Cloud Applications versions 22.3-26.5 contain an authorization vulnerability that allows low-privilege internal users to bypass access controls and read all data stored in the CRM…

How to fix or mitigate CVE-2026-60690?

Within 24 hours: Inventory all Siebel Cloud Manager instances in your environment running versions 22.3-26.5 and classify the sensitivity of stored data (PII, financial records, competitive data). Within 7 days: Implement network access controls restricting HTTP/HTTPS connections to Siebel Cloud Manager to known administrative networks only; apply principle-of-least-privilege role configurations to disable unnecessary data-export functions for non-administrative users; enable comprehensive audit logging for data-access and export operations with real-time alerting on bulk-query patterns. By day 30: Escalate to Oracle Support to establish patch-release timeline; if no patch emerges within 30 days, execute a phased remediation plan to upgrade all affected instances to versions beyond 26.5 or evaluate architectural alternatives to reduce data exposure.

Oracle Siebel CRM CVE-2026-60690

EUVD-2026-47045 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-gmx5-4x4c-qwxp

Authentication Bypass Oracle Siebel Crm

7.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.7 HIGH

Network HTTP access with a valid low-privilege session (PR:L, AV:N, AC:L); cross-boundary data exposure gives S:C and C:H, with no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:43 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.7

DescriptionCVE.org

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Unauthorized data access in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3 through 26.5) allows a low-privileged attacker with network HTTP access to read all data accessible to the application. Oracle rates it CVSS 3.1 7.7 with a scope change, and the ENISA EUVD flags an authentication-bypass characteristic, meaning a minimally-authenticated actor can escalate to broad confidentiality compromise that spills into additional connected products. No public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Siebel CRM is Oracle's enterprise customer relationship management suite; the affected piece is the Siebel Cloud Manager, the cloud provisioning and management layer that orchestrates Siebel deployments and brokers access between the CRM application tier and surrounding cloud services. The vulnerability sits in the HTTP-facing management surface of this component. Oracle assigned no CWE, but the 'Authentication Bypass' tag combined with the scope-change and confidentiality-only impact profile is consistent with a broken access-control or authorization weakness (broadly the CWE-284/CWE-285 class) in which a low-privilege session reaches data or functions belonging to other tenants or higher-privilege contexts. The scope change (S:C) in the CVSS vector indicates the vulnerable Cloud Manager can affect resources beyond its own security authority - namely other Siebel CRM Cloud Applications data.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); no specific fixed build number is stated in the available data, so consult the CPU patch matrix for the exact level corresponding to your 22.3-26.5 release - Patch available per vendor advisory. Because the affected surface is the network HTTP management interface, interim compensating controls are: restrict network reachability of the Siebel Cloud Manager endpoints to trusted management networks or VPN (trade-off: may disrupt legitimate remote administration); place the application behind a WAF or reverse proxy with tightened authentication and per-tenant authorization checks (trade-off: cannot fully substitute for the vendor fix against an authorization-logic flaw); and minimize low-privilege account grants while auditing access logs for cross-tenant or anomalous data reads (trade-off: detective, not preventive). Given the scope change, also validate that connected downstream Siebel Cloud Applications enforce their own access controls rather than trusting the Cloud Manager.