EUVD-2026-61498
GHSA-m252-xp3c-6hm4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Siebel Cloud Manager over HTTP
-
DeliverySend crafted unauthenticated request
-
ExploitBypass authentication
-
ExecutionRead all Siebel CRM Cloud data
-
PersistWrite/delete limited records and trigger partial DoS
-
ImpactPivot to impacted adjacent products
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only network HTTP reachability to the Siebel Cloud Manager component of Siebel CRM Cloud Applications on an affected version (22.3-26.6); per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there is no authentication, no user interaction, and low complexity - effectively no special conditions beyond the component being network-exposed against a supported-but-unpatched deployment. The primary limiting factor is exposure: organizations that keep Siebel Cloud Manager off the public internet (behind VPN or IP allowlists) materially raise the bar, and only the specific listed versions running the Cloud Manager component are in scope. The scope change (S:C) is what extends impact to adjacent products. |
| Impact | Every available signal points to high priority: the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L describes network-reachable, low-complexity, unauthenticated exploitation with a scope change and high confidentiality impact, yielding a 9.9 base score, and Oracle's own advisory language ('easily exploitable', 'unauthenticated attacker with network access via HTTP') reinforces that. Countervailing signals are limited: there is no EPSS score in the provided data, the CVE is not in CISA KEV, and no proof-of-concept is referenced, so this is a critical-but-not-yet-actively-exploited issue rather than a confirmed in-the-wild threat. The main uncertainty is qualitative asymmetry in the vector - confidentiality is High but integrity and availability are only Low, so the realistic worst case is mass data exposure more than full system takeover; the scope change nonetheless means blast radius may extend to adjacent products. Given internet-facing Siebel Cloud Manager exposure, defenders should treat patching as urgent even before EPSS or KEV data matures. |
| Exploit ScenarioDerived | An attacker who can reach the Siebel Cloud Manager HTTP interface sends a crafted request that bypasses authentication and queries Siebel CRM Cloud data, exfiltrating sensitive customer records without any credentials or user interaction. Because the flaw has a scope change, the same access can be pivoted to affect connected products, and limited write access could let the attacker tamper with records or trigger a partial service outage. No public proof-of-concept is currently identified, so this reflects the plausible path implied by the CVSS vector rather than an observed exploit. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 19, 2026
Unauthenticated remote compromise of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) is possible through the Siebel Cloud Manager component via crafted HTTP requests, requiring no privileges or user interaction. An attacker can gain full read access to all Siebel CRM Cloud data, perform limited unauthorized writes, and cause a partial denial of service, and because the flaw carries a scope change, exploitation can significantly impact additional connected products beyond Siebel itself. Rated CVSS 9.9; no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Apply the fixes delivered in Oracle's August 2026 Critical Security Patch Update per the advisory at https://www.oracle.com/security-alerts/cspuaug2026.html; the intelligence marks a patch available per vendor advisory but does not enumerate an exact fixed build, so identify the corresponding CPU patch level for your Siebel release (22.3-26.6) directly from that document. Until patched, reduce exposure by restricting network reachability of the Siebel Cloud Manager component - place it behind a VPN or restrict inbound HTTP to known management IP ranges, and terminate/inspect traffic at a WAF or reverse proxy to filter anomalous requests to Cloud Manager endpoints; the trade-off is that overly broad IP restrictions may disrupt legitimate cloud-provisioning automation, so scope allowlists to operational sources. Monitor Cloud Manager access logs for unauthenticated requests reaching privileged paths as a detective control while remediation is staged.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected technology is Oracle Siebel CRM, a long-established enterprise customer-relationship-management platform, specifically its Cloud Applications delivery and the Siebel Cloud Manager component that orchestrates cloud provisioning and management. The vendor supplies no CWE, but the tags 'Authentication Bypass' and 'Denial Of Service' combined with the CVSS vector (PR:N, S:C) point to a root cause in the component's request handling or authentication logic that allows an unauthenticated HTTP caller to reach privileged functionality and to cross a trust boundary into other components (the scope change). No CPE strings were provided in the intelligence; affected-product identity rests on the Oracle/EUVD version metadata rather than formal NVD CPE match rules.
Know when Siebel Crm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L
Vendor-described unauthenticated network HTTP access with low complexity gives AV:N/AC:L/PR:N/UI:N; scope change to adjacent products yields S:C with high confidentiality but only limited integrity and availability impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data as well as unauthorized update, insert or delete access to some of Siebel CRM Cloud Applications accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Siebel CRM Cloud Applications. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L).
Executive ViewAI
Oracle Siebel CRM Cloud Applications (versions 22.3-26.6) are vulnerable to unauthenticated remote compromise through the Siebel Cloud Manager component, enabling attackers to exfiltrate all CRM data without credentials. The vulnerability carries a scope-change impact, potentially compromising connected enterprise systems downstream. No patch is currently available, requiring immediate compensating controls for organizations running affected versions.
Enforce strict network segmentation isolating Siebel Cloud Manager from direct internet exposure; restrict access via IP whitelisting and VPN-only policies. Deploy WAF rules to block malformed HTTP requests targeting the vulnerable component. Implement continuous audit logging and alerting on all data access patterns. Consider air-gapping or bastion-host deployment for affected instances. Audit and restrict third-party integrations connected to Siebel to minimize scope-change propagation. Monitor vendor advisories daily for patch availability and test immediately in non-production environments upon release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Siebel Crm
View allPrivilege-based takeover of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) is possible via the Siebel
Full compromise of Oracle Siebel CRM Integration (Open Integration component) is achievable by a low-privileged, network
Privilege escalation to full takeover in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions
Full application takeover in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 throug
Full compromise of Oracle Siebel CRM Integration (Open Integration component) is possible by an unauthenticated remote a
Remote takeover of Oracle Siebel CRM Administration is possible via its Data Archival component, where an unauthenticate
Authentication bypass in the Server Infrastructure component of Oracle Siebel CRM Deployment (supported versions 17.0 th
Authentication bypass in the Server Infrastructure component of Oracle Siebel CRM Deployment (versions 17.0 through 26.7
Unauthenticated attackers with network reachability to the Siebel CRM Open UI SOAP interface can bypass authentication i
Full system takeover in Oracle Siebel CRM Deployment's Server Infrastructure component is achievable by any low-privileg
Full application takeover in Oracle Siebel CRM Cloud Applications (versions 22.3-26.6) is achievable by any low-privileg
Siebel Cloud Manager in Oracle Siebel CRM Cloud Applications exposes a network-accessible, low-complexity attack path th
Exploit-DB