Oracle Siebel CRM CVE-2026-61321

Exploitation requires possession of a valid low-privileged account within the Siebel CRM Cloud Applications environment (PR:L per CVSS vector) and network-level HTTP access to the Siebel Cloud Manager component. No victim interaction is required (UI:N), and attack complexity is low (AC:L), meaning no special timing, race conditions, or environmental prerequisites apply. The deployment must be running an affected version between 22.3 and 26.6 inclusive. Fully unauthenticated exploitation from the open internet is not indicated by the CVSS vector - an attacker must first obtain or already hold valid Siebel credentials. Exploitation is limited to the data scope accessible to Siebel CRM Cloud Applications; there is no scope change (S:U) indicating lateral movement to adjacent systems.

The CVSS 3.1 score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects a serious but not maximally-rated vulnerability: exploitation requires a low-privileged credential (PR:L), which prevents fully unauthenticated mass exploitation but represents a realistic threat from insider actors, compromised service accounts, or phishing victims. Attack complexity is low (AC:L), meaning no race conditions, specific timing, or advanced knowledge are required once credentials are obtained. The high C and I impacts indicate full data exposure and write access across all CRM-accessible data. No EPSS score was provided, limiting probability-based quantification. No CISA KEV listing is present, and no public POC has been identified - exploitation appears opportunistic rather than widespread at this time. However, Siebel CRM environments typically store sensitive enterprise customer, sales pipeline, and contract data, elevating the business impact significantly above a typical data-exposure finding. The 'Authentication Bypass' tag introduces some ambiguity: if the bypass allows escalation from PR:L to effective PR:N behavior post-authentication, real-world exploitability may be higher than the raw CVSS score conveys.

An attacker with a low-privileged Siebel CRM account - such as a standard sales user, a compromised service account, or a phishing victim - sends crafted HTTP requests to the Siebel Cloud Manager endpoint, exploiting the authorization bypass to escalate effective data access. Without triggering additional authentication prompts or requiring any victim interaction, the attacker reads the complete CRM dataset (customer records, pipeline data, contracts) and can alter or delete critical records. No public POC is known at time of analysis, but AC:L indicates a technically capable attacker could replicate the exploit with moderate effort given credential access.