Siebel CRM CVE-2026-61326

The attacker must hold a valid low-privileged credential within the Oracle Siebel CRM Cloud Applications environment, consistent with CVSS PR:L; fully unauthenticated exploitation is not supported by available data. Exploitation occurs over standard HTTP with no victim interaction required, and no special non-default configuration is needed - any deployment of Siebel CRM Cloud Applications running versions 22.3 through 26.6 with the Siebel Cloud Manager component network-accessible is in scope. The scope change (S:C) means that once the Cloud Manager authorization boundary is bypassed, data from additional integrated Oracle products may also be reachable. Key limiting factors: the attacker must first obtain or already possess a valid account credential (even a minimal-privilege one), precluding fully anonymous external attacks and making insider threat, credential stuffing, or phished-credential scenarios the primary realistic attack paths. No specific non-default feature toggle or protocol configuration has been identified as a prerequisite beyond having a valid account and HTTP reachability to the Siebel Cloud Manager endpoint.

The CVSS 3.1 base score of 8.5 is well-supported by the vector: network reachability (AV:N), low complexity (AC:L), no user interaction (UI:N), a scope change (S:C), and a high confidentiality impact (C:H) together produce a genuine priority-tier finding. EPSS data was not included in available intelligence, so probabilistic exploitation likelihood cannot be precisely quantified; however, the low attack complexity and low privilege barrier mean that functional exploit development is not technically demanding for a capable threat actor. This CVE is not listed in the CISA KEV catalog and no public POC has been identified at time of analysis, which slightly moderates near-term urgency compared to actively exploited equivalents - but even a mid-sized enterprise IT team managing Siebel deployments in a city like sanok should treat this as an urgent patching priority given that the scope change implies a single compromised low-privileged account could expose data across the broader integrated environment. The integrity impact is limited (I:L), so this is primarily a mass data exfiltration risk rather than a full destructive compromise vector; availability is unaffected (A:N). The Authentication Bypass reporter tag introduces mild ambiguity about the exact root cause, which could affect the precision of compensating controls; the absence of a formal CWE should be treated as a gap when scoping detective and preventive mitigations.

An attacker holding any valid low-privileged Siebel CRM Cloud account - such as a standard end-user, a service account, or credentials obtained via phishing - sends crafted HTTP requests to the exposed Siebel Cloud Manager component, bypassing server-side authorization enforcement to retrieve confidential CRM records across the full data set accessible to the application. Because attack complexity is rated low and no user interaction is required, the attacker needs only knowledge of the vulnerable endpoint structure to proceed. No public exploit code has been identified at time of analysis, but the low technical barrier makes independent exploit development feasible for motivated threat actors.