Siebel Apps - Marketing CVE-2026-60752

Exploitation requires a valid low-privileged account with network access to the Siebel Apps - Marketing component over HTTP, as confirmed by the CVSS vector (PR:L, AV:N). The CVSS metrics AC:L and UI:N indicate no special system configuration and no victim interaction are required beyond the attacker possessing valid credentials. The vulnerability affects Siebel Apps - Marketing in versions 17.0 through 26.6 when the Marketing component is network-accessible via HTTP. Limiting factors include the requirement for at least a low-privileged authenticated Siebel account - unauthenticated external attackers cannot exploit this without valid credentials, and the unchanged scope (S:U) means exploitation is contained to the Siebel Apps - Marketing component without directly pivoting to adjacent systems. Organizations where Siebel Marketing is deployed exclusively on isolated internal networks or where low-privileged user provisioning is tightly controlled and audited have a substantially reduced attack surface.

The CVSS 3.1 score of 7.1 (High) reflects a meaningful but bounded threat: network-exploitable over HTTP with low attack complexity and requiring only a low-privileged account, yielding high confidentiality impact described by Oracle as 'complete access to all Siebel Apps - Marketing accessible data.' The 'Authentication Bypass' tag suggests that a low-privileged authenticated user may escalate data access beyond their intended authorization boundary, which amplifies real-world impact beyond a simple information disclosure. No EPSS exploitation probability data was included in the intelligence feed, making quantitative likelihood assessment unavailable; however, the combination of low access complexity, no user interaction requirement, and a broad affected version range means that even a mid-sized municipal IT team in kielce running a long-standing Siebel deployment should treat this as urgent once Oracle's patch is validated for their release track. The absence of a CISA KEV listing and no reported public exploit code moderates urgency compared to actively exploited vulnerabilities, but the high confidentiality impact for organizations where the Marketing module processes sensitive customer or campaign data remains significant. The secondary partial denial-of-service (A:L) is a lower concern. The 'Authentication Bypass' tag appears to conflict slightly with PR:L in the CVSS vector - if a full authentication bypass were possible, PR:N would be expected; security teams should verify the exact exploitation mechanism against Oracle's full advisory.

An attacker holding a low-privileged Siebel account - such as a standard marketing analyst or a compromised service account - sends crafted HTTP requests to the Marketing component, exploiting broken access control to retrieve data beyond their authorized scope. The attacker exfiltrates complete marketing datasets including campaign records, customer contact lists, or lead pipeline data, potentially also triggering partial service degradation for legitimate users. No public exploit code has been identified at time of analysis, so exploitation currently requires attacker-developed tooling or knowledge of the specific vulnerable endpoint and request structure.