Oracle Siebel CRM CVE-2026-60713

The attacker must have an existing logon to the infrastructure (server or host environment) where Siebel CRM Cloud Applications executes - this is a strictly local attack (AV:L) and remote unauthenticated exploitation is not possible. A low-privileged account is required (PR:L); accounts with no infrastructure logon cannot exploit this flaw. The Siebel Cloud Manager component must be deployed and reachable by the attacker's session. Affected deployment versions are limited to 22.3 through 26.5. The scope of impact is bounded: only some of the data accessible to Siebel CRM Cloud Applications can be read or modified - full system or database compromise is not indicated by the CVSS impact ratings. Availability of the application is not impacted. Key limiting factors are the local access requirement and the low data impact ceiling, which together mean the realistic attacker population is limited to insiders, compromised internal accounts, or co-tenants on shared infrastructure.

The CVSS 3.1 score of 4.4 (Medium) is internally consistent with the provided vector: local attack vector (AV:L) requires physical or logical infrastructure access, low complexity (AC:L), low privilege (PR:L), no user interaction (UI:N), unchanged scope (S:U), and limited confidentiality and integrity impact (C:L/I:L) with no availability impact (A:N). These metrics collectively indicate that exploitation is not remotely triggerable and is bounded to partial data exposure. No EPSS score is available in the provided data, so probabilistic exploitation likelihood cannot be quantified. This vulnerability is not listed in the CISA KEV catalog, and no public POC has been identified. The 'Authentication Bypass' tag elevates concern slightly - bypass flaws can sometimes be chained with other weaknesses - but the CVSS impact ceilings (Low C and I) suggest Oracle assessed the exploitable data as limited in sensitivity or scope. Real-world priority is highest for organizations with shared or multi-tenant infrastructure hosting Siebel CRM Cloud Applications, where untrusted local users may co-reside. For externally isolated deployments, this is a low operational priority pending the scheduled CPU application.

An attacker with a low-privileged account on the Siebel CRM Cloud Applications host - such as a service account, a compromised internal user, or a co-tenant on shared infrastructure - invokes the authentication bypass within Siebel Cloud Manager to read CRM records or insert and modify data entries outside their normal permission boundary. Because no public exploit code has been identified, exploitation currently requires manual enumeration of the bypass technique by an attacker with infrastructure access.