What is the CVSS score of CVE-2026-60705?

CVE-2026-60705 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of Siebel Crm are affected by CVE-2026-60705?

Oracle Siebel CRM Cloud Manager (versions 22.3-26.5) contains an unauthenticated remote vulnerability allowing attackers to access customer data and modify records.

How to fix or mitigate CVE-2026-60705?

Within 24 hours, identify all Siebel Cloud environments and confirm versions in use (22.3-26.5 scope); review access logs for suspicious activity and data access patterns. Within 7 days, implement network segmentation and WAF rules to restrict Siebel Cloud access, enable enhanced monitoring for anomalous API activity, and contact Oracle for patch availability timeline and interim guidance. Within 30 days, evaluate upgrade paths to versions outside the vulnerable range, prioritize remediation for instances handling sensitive customer data, and establish a patching schedule once vendor updates become available.

Siebel Crm CVE-2026-60705

EUVD-2026-47055 HIGH

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-f367-3f4c-8qhc

Authentication Bypass Denial Of Service Information Disclosure Oracle Siebel Crm

7.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.0 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:32 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.0

DescriptionCVE.org

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data as well as unauthorized update, insert or delete access to some of Siebel CRM Cloud Applications accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Siebel CRM Cloud Applications. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L).

AnalysisAI

Unauthorized data access in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 through 26.5, lets an unauthenticated remote attacker over HTTP read all Siebel-accessible data, tamper with some records, and cause a partial denial of service. Oracle rates it CVSS 7.0 but flags it as difficult to exploit (AC:H), and no public exploit identified at time of analysis. Disclosed via the Oracle July 2026 Critical Patch Update.