Siebel CRM Integration CVE-2026-60820

Exploitation requires network-level HTTP access to the Oracle Siebel CRM Integration REST API component. No authentication is required (PR:N) and no user interaction is needed (UI:N). The primary limiting factor is High Attack Complexity (AC:H), indicating that the attacker must meet specific conditions - such as a race condition, particular server state, or precise request construction - beyond basic network reachability; the exact technical prerequisite is not disclosed in the advisory. Scope is unchanged (S:U), confining the impact to the Siebel CRM Integration system rather than enabling lateral movement to other systems. Deployments where the REST endpoint is not externally reachable (e.g., restricted to internal networks or protected behind an API gateway with independent authentication) have substantially reduced exposure.

The CVSS 3.1 score of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects a high-severity vulnerability with complete confidentiality and integrity impact, moderated by the non-trivial attack complexity. The AC:H metric is the primary mitigating factor - exploitation is not a simple, fire-and-forget request but requires meeting specific conditions that are not fully described in the advisory, reducing the likelihood of opportunistic mass exploitation. There is no CISA KEV listing, no public POC code, and no EPSS score is available in the provided data, meaning real-world exploitation likelihood cannot be quantified beyond CVSS signals. The 'Authentication Bypass' tag elevates concern: if the bypass is reliably reproducible under attainable conditions, the effective risk is closer to the upper bound of the score. Even a mid-sized municipal IT team in tczew should treat this as urgent if the Siebel REST integration endpoints are Internet-facing, given the potential for complete CRM data exfiltration without any credentials. The absence of an availability impact (A:N) limits denial-of-service risk, but CRM systems typically hold sensitive customer, sales, and operational data, making C:H and I:H highly consequential in practice.

An unauthenticated attacker with network access to the Siebel CRM Integration REST API crafts HTTP requests that exploit the authentication bypass under specific server-side conditions consistent with the AC:H complexity rating. Once the bypass condition is met - potentially a race condition, specific request sequencing, or a server state dependency - the attacker gains unrestricted access to read all CRM data or issue unauthorized create, modify, and delete operations against the integration data store. No public proof-of-concept code has been identified at time of analysis.