Oracle Siebel CRM CVE-2026-60711

Exploitation requires network access to the Siebel Cloud Manager component over HTTP and a low-privileged authenticated account on the Siebel CRM Cloud Application (CVSS PR:L), with no user interaction (UI:N) and low attack complexity (AC:L). The concrete prerequisite is reachability of the Siebel Cloud Manager HTTP endpoint plus any valid low-privilege credential - it is NOT unauthenticated. Limiting factors that reduce real-world risk: the attacker must first possess or acquire a low-privileged account, and the Cloud Manager interface must be network-reachable from the attacker's position, so deployments that isolate Cloud Manager to trusted management networks and tightly control account provisioning materially raise the bar. The affected surface is bounded to supported versions 22.3 through 26.5.

All confirmed signals point to genuine high priority: the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) shows remote reachability over HTTP, low attack complexity, only low privileges required, no user interaction, a scope change, and full confidentiality/integrity/availability impact - yielding 9.9, near maximum. Countervailing signals temper urgency: this is not in CISA KEV (no confirmed active exploitation), no EPSS score was provided to gauge exploitation probability, and no public POC was identified. There is also a data tension worth flagging - the Oracle tag reads 'Information Disclosure' while the description and metrics describe full 'takeover' with high integrity and availability impact; the CVSS metrics should be treated as authoritative over the terse tag. On balance this is a real priority rather than an inflated high-CVSS-but-low-real-risk item, because a low-privileged account plus network HTTP reach and scope change is exactly the profile attackers weaponize once details surface - but the absence of KEV, POC, and EPSS data means exploitation is not yet observed and timelines are uncertain.

An attacker who holds or obtains a low-privileged account on a Siebel CRM Cloud deployment sends crafted HTTP requests to the reachable Siebel Cloud Manager component. Leveraging the low-complexity flaw, they escalate to full control of the Siebel CRM Cloud Application, then use the scope change to pivot into additional connected products and exfiltrate or alter CRM data. No public POC was identified at time of analysis, so this reflects the vector implied by the CVSS metrics rather than a demonstrated exploit.