Siebel CRM CVE-2026-60798

Exploitation requires a valid low-privilege account with HTTP network access to the Siebel CRM Deployment instance running versions 17.0 through 26.6. The CVSS vector confirms PR:L - some form of authenticated access is required, and fully unauthenticated exploitation is not indicated. However, the 'Authentication Bypass' tag suggests that low-privilege credentials may be sufficient to circumvent the authorization controls protecting higher-privilege data and operations within the Migration component, making the effective access barrier lower than a standard PR:L classification might imply. No user interaction is required (UI:N) and attack complexity is low (AC:L), meaning no race conditions, special timing, or non-default configuration states are needed beyond the attacker possessing any valid low-privilege credential. The primary factor limiting exploitation is the requirement for at least one valid account in the target Siebel deployment.

The CVSS 3.1 score of 8.5 is well-supported by the underlying vector: network-accessible, low complexity, no user interaction, and a scope change that amplifies the blast radius beyond the immediately compromised component. The 'Authentication Bypass' tag is the most analytically significant signal here - it implies that low-privilege credentials (PR:L) may be sufficient not merely to authenticate but to circumvent higher-privilege authorization controls within the Migration component, effectively collapsing the access boundary between privilege tiers. EPSS data is absent from the available intelligence, which forecloses probabilistic exploitation forecasting; this gap should be treated as a data-completeness issue rather than a signal of low risk. No CISA KEV listing and no identified public proof-of-concept reduce immediate urgency modestly, but the low attack complexity means that any organization that patches slowly is genuinely exposed - even a mid-sized municipal IT team in gdynia running a long-standing Siebel deployment spanning the wide version range (17.0-26.6) should treat this as a near-term remediation priority given the data-exposure risk. The scope change to additional products is a confirmed vendor statement, not an inference, and materially elevates the real-world risk beyond what a standalone CRM data-access flaw would ordinarily warrant.

An attacker holding a valid low-privilege Siebel CRM account - obtained through credential reuse, phishing, or insider access - sends crafted HTTP requests to the Migration component of the Siebel CRM Deployment service, exploiting the authorization bypass to read critical CRM records (customer contracts, financial data, account details) that should be restricted to higher-privilege roles, and makes unauthorized inserts or modifications to a subset of accessible data. The scope change means that compromise may extend to additional Oracle components co-deployed in the same environment, potentially broadening the impact beyond the CRM data tier. No public proof-of-concept exploit code has been identified, but the low attack complexity (AC:L) means that exploitation does not require specialized tooling or advanced technical capability beyond basic HTTP request crafting.