EUVD-2026-61439
GHSA-mcvm-8qhf-3mw6
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Network-accessible REST API with no credentials needed, but AC:H reflects specific exploitation conditions; no availability impact and no scope change align with the advisory description.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: REST). Supported versions that are affected are 17.0-26.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM Integration accessible data as well as unauthorized access to critical data or complete access to all Siebel CRM Integration accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
AnalysisAI
Unauthenticated remote exploitation of Oracle Siebel CRM Integration's REST component across versions 17.0 through 26.6 can yield complete loss of data confidentiality and integrity. Tagged as an authentication bypass, the vulnerability permits network-accessible attackers to read all CRM data and perform unauthorized create, delete, or modify operations without credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network-level HTTP access to the Oracle Siebel CRM Integration REST API component. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects a high-severity vulnerability with complete confidentiality and integrity impact, moderated by the non-trivial attack complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker with network access to the Siebel CRM Integration REST API crafts HTTP requests that exploit the authentication bypass under specific server-side conditions consistent with the AC:H complexity rating. Once the bypass condition is met - potentially a race condition, specific request sequencing, or a server state dependency - the attacker gains unrestricted access to read all CRM data or issue unauthorized create, modify, and delete operations against the integration data store. … |
| Remediation | Apply the patch issued by Oracle in the August 2026 Critical Security Patch Update, documented at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Oracle Siebel CRM Integration versions 17.0-26.6 and assess network exposure of the REST API endpoint; implement temporary network segmentation or WAF rules to restrict REST API access to trusted sources only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today