Oracle Siebel CRM CVE-2026-61339

The attacker must hold an existing low-privileged logon account on the infrastructure where Siebel CRM Cloud Applications executes - this is a hard prerequisite; remote unauthenticated exploitation is not possible given AV:L/PR:L. The affected component is Siebel Cloud Manager specifically, so the vulnerability is conditional on Cloud Manager being deployed in the environment. The version range 22.3 through 26.6 must be in use; installations outside this range are not stated to be affected. No user interaction is required once infrastructure access is established. What limits exploitation: the local attack vector means external internet-facing attackers cannot directly trigger this without first compromising an infrastructure account; availability impact is nil, so data destruction or service disruption is not achievable through this flaw alone; integrity impact is partial (I:L), meaning full data modification is not enabled.

The CVSS 3.1 base score of 7.3 reflects a meaningful but locally-constrained threat: AV:L limits exploitation to actors who already hold infrastructure logons, AC:L means no special timing or race conditions are needed, and PR:L requires only a standard low-privileged OS account. The scope change (S:C) elevates the score and real-world risk because a single compromised low-privilege account can cascade impact to additional products on the same infrastructure. Confidentiality impact is High (C:H), meaning complete CRM data exposure is achievable; Integrity impact is Low (I:L), limiting but not eliminating write-side risk; Availability is unaffected (A:N). EPSS data was not provided, making probabilistic exploitation forecasting unavailable for this CVE. KEV status is negative - CISA has not confirmed active exploitation. No POC is publicly identified. The 'Authentication Bypass' tag is the most operationally significant signal: bypassing auth in a cloud management plane is a high-value attack primitive, especially in environments where Siebel Cloud Manager governs multiple tenant or application instances. For organizations running Siebel CRM Cloud on shared or multi-tenant infrastructure, the scope change amplifies realistic blast radius considerably beyond the base CVSS score suggests.

An attacker who has obtained or already holds a low-privileged OS account on the Siebel CRM Cloud Applications hosting infrastructure authenticates to the Siebel Cloud Manager component and exploits the authentication bypass to elevate their effective application privileges. They then extract the full CRM dataset - including customer records, sales data, and potentially sensitive PII - and make targeted data modifications; the scope change means co-hosted Siebel applications or dependent products on the same infrastructure may also be compromised. No public POC has been identified, but the low attack complexity (AC:L) and lack of required user interaction mean exploitation would be straightforward for any actor with infrastructure access.