What is the CVSS score of CVE-2026-60711?

CVE-2026-60711 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Siebel CRM are affected by CVE-2026-60711?

A critical flaw in Oracle Siebel CRM (versions 22.3-26.5) enables low-privileged users to gain complete platform takeover and pivot to other business systems, without any vendor patch currently…

How to fix or mitigate CVE-2026-60711?

Within 24 hours, inventory all Siebel CRM instances in versions 22.3 through 26.5, assess network exposure of the Siebel Cloud Manager component, and establish communication with affected business units regarding exploitation risk and remediation timeline. Within 7 days, implement network segmentation and firewall rules to restrict Cloud Manager HTTP access to trusted networks only, audit and restrict all low-privileged user accounts as primary attack vectors, and deploy WAF rules to detect and filter suspicious HTTP traffic to the vulnerable component. By day 30, monitor Oracle advisories daily and apply the vendor-released patch to all affected instances immediately upon availability, conduct comprehensive functional and security testing across integrated applications to verify no breach has occurred, and perform a scope assessment of all data and systems accessible from Siebel instances to quantify potential breach impact.

Oracle Siebel CRM CVE-2026-60711

EUVD-2026-47060 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-2h7v-5p5c-38xm

Authentication Bypass Oracle Siebel Cloud Manager

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Remote HTTP reach and low complexity give AV:N/AC:L; a low-privilege account is required so PR:L not PR:N; scope change and full takeover justify S:C and C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:29 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.9

DescriptionCVE.org

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Siebel CRM Cloud Applications. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full application takeover in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.5) allows a low-privileged, network-based attacker to compromise the product via HTTP through the Siebel Cloud Manager component. Because the flaw carries a scope change, successful exploitation can pivot beyond Siebel to significantly impact additional connected products, driving the rare CVSS 9.9 rating. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and low privilege bar make it a high-priority patch item.

Technical ContextAI

The affected component is Siebel Cloud Manager, the orchestration and provisioning layer used to deploy and manage Oracle's Siebel CRM Cloud Applications. Siebel is a large enterprise CRM suite with numerous integrated modules and back-end connections, which is why Oracle flags a scope change (S:C) - the manager component sits at a trust boundary and its compromise can cascade into other managed systems. Oracle did not assign a CWE (CWE: N/A) and the source tag reads 'Information Disclosure', but the CVSS impact set (C:H/I:H/A:H) plus the explicit 'takeover' language points to an authorization or privilege-boundary weakness rather than a mere read-only disclosure. Without a CWE or vendor technical write-up, the exact root-cause class (for example broken access control, injection, or an SSRF-style pivot) cannot be confirmed from the provided data.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update (CPU) of July 2026 - Patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html; Oracle CPUs bundle the patched builds, so upgrade every Siebel CRM Cloud Application instance in the affected 22.3-26.5 range to the CPU-remediated release (no standalone fix version number was published in the provided data, so consult the CPU patch matrix for the exact patch). Until patched, reduce exposure by restricting network access to the Siebel Cloud Manager HTTP interface so it is reachable only from trusted management networks or via VPN/bastion (trade-off: may disrupt legitimate remote administration and automation), tightening account provisioning to minimize the number of low-privileged accounts that can reach the component (since PR:L means any low-privileged user is a potential actor), and increasing WAF and endpoint logging on the Cloud Manager interface to detect anomalous requests. Because a scope change is involved, also review and segment the trust relationships between Siebel Cloud Manager and downstream managed products to limit lateral impact if the manager is compromised.