Siebel Apps - Marketing CVE-2026-60803

Network access via HTTP to the Oracle Siebel Apps - Marketing component is required. The CVSS vector specifies AC:H (High Attack Complexity), meaning exploitation is not straightforward - a specific precondition must be satisfied, such as a particular application state, race condition, configuration mode, or sequence of requests; however, the exact nature of this condition is not disclosed in the available data. PR:N confirms no authentication or account is required. UI:N confirms no victim interaction is needed. Exploitation is limited by the high complexity bar, which reduces the realistic population of attackers able to execute the bypass without prior knowledge or research into the specific triggering condition. S:U (Unchanged scope) means the impact is confined to the Siebel Marketing component and its accessible data - lateral movement to other system components is not implied by the CVSS scope change metric. There is no indication this requires a non-default configuration; the vulnerability appears to be present in any standard deployment of the affected version range.

The official CVSS 3.1 score of 7.4 (High) reflects a network-accessible, unauthenticated attack path with high confidentiality and integrity impact but no availability impact. The AC:H metric is the primary risk moderator: while no credentials are needed, exploitation is described as 'difficult,' implying specific conditions must be met that are not present in every default deployment. The 'Authentication Bypass' tag raises the practical severity above what AC:H alone might suggest, since a successful bypass eliminates all access control protections for the Marketing component, yielding complete read and write access to all marketing data. No EPSS score was provided in the input, and no active exploitation has been confirmed via CISA KEV. No public proof-of-concept exploit has been identified at time of analysis. The combination of PR:N and authentication bypass semantics means that if the high-complexity bar is cleared - whether through research, tooling, or insider knowledge of the specific condition - the attack requires no account and no victim interaction, making it fully attacker-controlled. Risk is elevated for organizations in highly targeted sectors (financial services, telecom, government) that commonly run Siebel CRM. The absence of an availability impact (A:N) limits denial-of-service scenarios but does not reduce the data exposure and data integrity risk.

An external attacker with HTTP access to the Siebel Marketing application identifies a specific state, parameter condition, or timing window that satisfies the high-complexity exploitation requirement, then sends a crafted HTTP request that bypasses the Marketing component's authentication gate. Once authenticated context is forged or bypassed, the attacker reads or exfiltrates all marketing campaign data, customer lists, and associated CRM records, or modifies that data to corrupt campaigns or cover tracks. No public proof-of-concept has been identified, but the self-contained PR:N nature of the attack means no internal account or victim interaction is required once the complexity condition is understood.