What is the CVSS score of CVE-2026-60704?

CVE-2026-60704 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle Siebel CRM are affected by CVE-2026-60704?

A critical authentication flaw in Oracle Siebel CRM Cloud Manager (versions 22.3-26.5) allows unauthenticated remote attackers to access sensitive customer and business data stored in affected cloud…

How to fix or mitigate CVE-2026-60704?

Within 24 hours, inventory all Siebel Cloud Manager instances to confirm whether versions 22.3-26.5 are deployed and identify network exposure; notify infrastructure and security teams immediately. Within 7 days, implement compensating controls by restricting network access to affected Siebel Cloud Manager endpoints via firewall rules and requiring VPN access; deploy Web Application Firewall (WAF) policies if available. Within 30 days, establish monitoring for an Oracle patch release and plan an upgrade strategy to unaffected versions once available, coordinating with stakeholders on deployment timing.

Oracle Siebel CRM CVE-2026-60704

EUVD-2026-47054 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-23g3-4x3j-2v7r

Authentication Bypass Oracle Siebel Crm

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network HTTP access with low complexity (PR:N/AV:N/AC:L) yielding broad data disclosure only, so C:H with I:N/A:N and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:32 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 through 26.5, lets a remote unauthenticated attacker reach sensitive data over HTTP. The flaw is tagged as an authentication bypass and, per Oracle's own scoring, is 'easily exploitable' with a high confidentiality impact but no integrity or availability effect (CVSS 3.1 base 7.5). No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided in the source data.

Technical ContextAI

The affected component is Siebel Cloud Manager, the orchestration/provisioning layer used to deploy and manage Oracle's Siebel CRM Cloud Applications (a large enterprise CRM suite covering sales, service, and marketing). The issue is exposed over HTTP to the network and, given the 'Authentication Bypass' tag combined with the CVSS PR:N metric, the root cause is most consistent with a missing or improperly enforced authentication/authorization check (broadly CWE-287/CWE-306 class), allowing access to protected data without valid credentials. The published CWE is N/A in the source data, so the precise weakness class is inferred rather than vendor-confirmed. No CPE strings were provided, so exact affected configurations rely on Oracle's version range (22.3-26.5) rather than machine-readable product identifiers.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); the source data does not name a single exact patched build, so treat the CPU as the authoritative source and apply the specific patch Oracle lists for your deployed Siebel CRM Cloud Applications version in the 22.3-26.5 range (patch available per vendor advisory; exact fixed version not independently confirmed here). As compensating controls until patched, restrict network reachability of the Siebel Cloud Manager endpoints - place them behind a VPN or IP allowlist and block untrusted inbound HTTP to the management/provisioning interface, accepting that this can disrupt legitimate remote administration and any integrations that call Cloud Manager over HTTP. Add WAF rules to inspect and rate-limit requests to Cloud Manager paths and enable enhanced access logging on those endpoints to detect anomalous unauthenticated data-access attempts, recognizing WAF rules are a stopgap that will not reliably block an authentication-bypass logic flaw.