Siebel Apps - Marketing CVE-2026-60751

A valid low-privileged Siebel CRM account is required (PR:L) - unauthenticated external attackers cannot exploit this vulnerability without first obtaining credentials. Network access via HTTP to the Siebel Apps - Marketing component is necessary (AV:N), which may be satisfied by internal network connectivity or, in externally-facing deployments, the internet. Attack complexity is low (AC:L), meaning no special configuration state, race condition, or non-default deployment mode is needed - the vulnerability is present in standard installations of versions 17.0 through 26.6. No user interaction is required (UI:N), so the attack is fully attacker-driven. The primary limiting factor is the requirement for a valid low-privileged account, which restricts exploitation to authenticated insiders, compromised credential holders, or attackers who have already gained initial access. No additional component, feature flag, or specific Siebel configuration was identified as a prerequisite in the available data.

The CVSS 3.1 score of 8.8 is well-supported by the provided vector: the attack is network-based, requires no elevated privileges (PR:L is the minimum bar of a valid account), involves no user interaction, and produces full C:H/I:H/A:H impact - a classic 'low-hanging fruit for insiders or compromised accounts' profile. No EPSS score was supplied, preventing probabilistic exploitation likelihood assessment. The vulnerability carries no CISA KEV listing at time of analysis, meaning confirmed active exploitation has not been publicly documented; however, KEV absence does not imply safety for a score of this severity and simplicity. The low attack complexity (AC:L) means no race conditions, special timing, or environmental dependencies are required - once a valid low-privileged account is available, exploitation is deterministic. The 'Information Disclosure' source tag conflicts with the full takeover characterization in the CVE text; the more severe outcome in the vendor description is treated as authoritative. Overall, this warrants urgent patching for any organization where Siebel Marketing is network-accessible to untrusted or semi-trusted user populations.

An attacker with a low-privileged Siebel CRM account - such as a marketing analyst, junior CRM user, or an account obtained via phishing or credential stuffing - sends a specially crafted HTTP request directly to the Marketing component's network-accessible endpoint. Because attack complexity is low and no user interaction is required, the exploit does not depend on timing, race conditions, or social engineering of additional parties. The attack results in full takeover of the Siebel Marketing application, potentially exposing customer campaign data, CRM records, and backend system access. No public proof-of-concept code has been identified at time of analysis.