Siebel CRM Deployment CVE-2026-60792

Exploitation requires unauthenticated network access to the Oracle Siebel CRM Server Infrastructure component over HTTP - meaning the Server Infrastructure HTTP listener must be reachable from the attacker's network. The CVSS AC:H rating indicates that beyond basic connectivity, specific additional conditions must be met - most likely a particular server processing state, timing window, race condition, or specific protocol interaction sequence; the exact condition is not specified in available disclosure data. No user interaction is required (UI:N), and no prior authentication is needed (PR:N), consistent with the Authentication Bypass classification. Exploitation is meaningfully constrained by the high attack complexity: casual, automated, or opportunistic exploitation is less likely than a deliberate, technically precise targeted attack. The primary limiting factor for defenders is the AC:H requirement, which reduces but does not eliminate risk, particularly against skilled adversaries with reconnaissance capability.

The CVSS 3.1 score of 7.4 reflects a material, high-severity vulnerability with important real-world nuance: AV:N confirms that the Siebel Server Infrastructure must be reachable over HTTP from an attacker-controlled network, while AC:H signals that exploitation is not straightforward and likely requires precise timing, a specific server state, protocol-level condition, or race window that must be carefully engineered. EPSS data is absent from available intelligence, preventing a probabilistic exploitation estimate. The absence of a CISA KEV listing means active exploitation has not been confirmed; no public exploit code has been identified at time of analysis, and the AC:H rating together makes near-term opportunistic mass exploitation less probable - though targeted, sophisticated attacks remain a credible threat given the Authentication Bypass classification. The impact profile is the most alarming signal: C:H and I:H with no availability impact means a successful attacker silently reads and manipulates the full CRM data estate without disruption, making detection harder. Even a mid-sized municipal IT operation in zabrze managing legacy enterprise deployments across a broad Siebel version range should treat the combination of authentication bypass and maximum confidentiality and integrity impact as an urgent patching priority. No contradictions were detected between the CVSS vector and the textual description.

An unauthenticated remote attacker identifies a Siebel CRM Server Infrastructure endpoint accessible over HTTP and engineers specific protocol conditions or server state required to satisfy the AC:H complexity requirement. By submitting a specially crafted HTTP request under those conditions, the attacker bypasses the Server Infrastructure's authentication checks and gains unrestricted access to all CRM-accessible data, reading sensitive customer and business records and silently creating, modifying, or deleting critical CRM data without ever supplying valid credentials. No public exploit code has been identified at time of analysis.