Siebel Apps - Marketing CVE-2026-60765

The attacker must possess a valid low-privileged account within the Oracle Siebel CRM environment (PR:L), must have network access to the Marketing component via HTTP, and must satisfy a high-attack-complexity condition (AC:H) - the specific trigger is not disclosed in available data but typically indicates a race condition, specific application state, or sequenced request pattern. Exploitation is limited by the requirement for prior authentication (no unauthenticated path is indicated by PR:L), by the AC:H barrier meaning the attack cannot be trivially automated or reliably replicated, and by the component-scoped blast radius (S:U indicates no scope change to other system components). No specific non-default configuration is mentioned as a prerequisite; the flaw appears present in the default Marketing component across all versions 17.0-26.6. User interaction is not required (UI:N).

The CVSS 3.1 base score of 7.5 reflects a genuine but non-trivial exploitation path: AV:N confirms remote reachability, but AC:H means the attack is difficult to reliably trigger, and PR:L requires the attacker to hold at least a low-privileged account within the Siebel environment. The full C:H/I:H/A:H impact triad supports the 'takeover' framing and is the most severe possible outcome. No EPSS score is provided in the available data, preventing probabilistic exploitation likelihood assessment. The vulnerability is not in CISA's Known Exploited Vulnerabilities catalog and no public proof-of-concept code has been identified, suggesting exploitation has not been widely observed. Real-world risk is elevated for organizations running Internet-facing or internally-shared Siebel CRM Marketing instances where low-privileged users (e.g., marketing staff) have HTTP access - the AC:H barrier lowers, though does not eliminate, the urgency. The 'Information Disclosure' tag conflicts with the full-takeover CVSS impact; defenders should treat the higher-severity CVSS description as authoritative until Oracle clarifies.

An authenticated attacker with a low-privileged Siebel CRM account - for example, a marketing coordinator - crafts a specific HTTP request targeting the Marketing component that satisfies the high-complexity precondition (such as a particular session state or race condition). Upon triggering the flaw, the attacker achieves full control over the Marketing component, enabling data exfiltration, data manipulation, or denial of service. No public proof-of-concept code has been identified, and the AC:H requirement means reliable, weaponized exploitation would demand meaningful attacker investment.