EUVD-2026-61500
GHSA-cgpf-mrh9-xhpw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege Siebel CRM credentials
-
DeliverySend crafted HTTP request to Cloud Manager
-
ExploitBypass authorization control
-
ExecutionModify or delete critical CRM data
-
ImpactTrigger repeatable application crash (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid low-privilege authenticated account on the Siebel CRM Cloud Applications instance (CVSS PR:L) and network access to the Siebel Cloud Manager HTTP interface (CVSS AV:N). No special non-default configuration, specific OS platform, or additional permissions beyond basic authentication are stated as prerequisites. Limiting factors include the requirement for at least one valid credential - unauthenticated external attackers are excluded. Risk is further bounded by whether the Cloud Manager interface is network-accessible: deployments where Cloud Manager is isolated to internal/administrative networks significantly reduce exploitability. The scope is limited to the Siebel CRM application boundary (S:U), so adjacent systems are not directly impacted. |
| Impact | The CVSS 3.1 base score of 8.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H) indicates an easily exploitable, network-reachable flaw requiring only low privileges - any authenticated user account suffices. Combined Integrity:High and Availability:High impacts make this a genuine operational threat: an attacker can corrupt or delete critical CRM records and crash the application on demand. No KEV listing is present, and no POC code has been identified, so active broad exploitation is not confirmed. EPSS data is absent, preventing probabilistic exploitation likelihood assessment. Oracle's own classification as 'Easily exploitable' in the advisory aligns with the AC:L/PR:L/UI:N vector. Real-world risk is elevated for organizations where Siebel Cloud Manager is Internet-accessible or accessible to untrusted internal users; organizations with strict network segmentation and minimal low-privilege account surface have meaningfully reduced exposure. The missing CWE is a gap - defenders cannot identify targeted controls without knowing the root cause class. |
| Exploit ScenarioDerived | An attacker holding any valid low-privilege Siebel CRM account sends crafted HTTP requests to the Siebel Cloud Manager interface. By manipulating request parameters or invoking privileged operations without adequate authorization checks, the attacker modifies or deletes critical CRM records across all accessible data, or submits requests that cause the Cloud Manager service to crash repeatedly. No public proof-of-concept code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 19, 2026
Compromise of Oracle Siebel CRM Cloud Applications (versions 22.3-26.6) is achievable by a low-privileged, network-authenticated attacker over HTTP targeting the Siebel Cloud Manager component. Successful exploitation yields unauthorized creation, deletion, or modification of critical CRM data (high integrity impact), partial unauthorized read of CRM data (low confidentiality impact), and the ability to cause a complete, repeatable denial-of-service crash of the application. No public exploit code and no CISA KEV listing are confirmed at time of analysis; EPSS data was not supplied in the source intelligence.
RemediationAI
Apply the Oracle Critical Security Patch Update for August 2026, available via the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. The advisory does not specify an exact patched version number in the data provided; consult My Oracle Support for the precise fix version applicable to your release track. As compensating controls while patching, restrict network access to the Siebel Cloud Manager HTTP interface using firewall rules or reverse-proxy ACLs to limit exposure to trusted administrator IP ranges only - this directly targets the AV:N vector and eliminates network-reachable attack surface. Additionally, audit and minimise low-privilege accounts with access to Cloud Manager functionality, since the vulnerability requires only PR:L. Note that restricting network access to Cloud Manager may affect administrative workflows that rely on remote HTTP access to that component.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Siebel CRM is a large-scale enterprise customer relationship management platform delivered as a cloud application. The vulnerable component is Siebel Cloud Manager, the administrative and orchestration layer responsible for managing cloud deployments. The attack vector is HTTP over the network with low-complexity conditions, indicating the flaw resides in an HTTP-accessible interface of the Cloud Manager. No CWE identifier is assigned, so the precise root cause class (e.g., improper authorization, injection, logic flaw) cannot be confirmed from available data. Affected versions span a multi-year range (22.3 through 26.6), suggesting the defect is present in the core platform rather than a transient feature. The CVSS vector S:U (scope unchanged) indicates impact is contained within the Siebel application boundary.
Know when Siebel Crm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Network HTTP access with low privileges and no user interaction; high integrity and availability impact matches data manipulation and crash capability; partial confidentiality aligns with subset read access described.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM Cloud Applications accessible data as well as unauthorized read access to a subset of Siebel CRM Cloud Applications accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel CRM Cloud Applications. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H).
Executive ViewAI
Oracle Siebel CRM Cloud (versions 22.3-26.6) contains an authentication-required vulnerability enabling attackers to alter customer data, disrupt service, and access sensitive information. Organizations running affected versions face integrity and availability risks to mission-critical sales and customer data. No patch is currently available, requiring immediate compensating controls.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access to Siebel Cloud Manager via firewall and network segmentation; (2) Implement WAF rules to detect and block malicious CRM data modification requests; (3) Reduce low-privileged account access to the application; (4) Enable comprehensive audit logging for all CRM data changes and access attempts; (5) Enforce multi-factor authentication for all administrative access; (6) Conduct immediate security assessment of Siebel deployment to identify lateral movement paths; (7) Engage vendor support to identify patched versions and accelerate upgrade planning.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Siebel Crm
View allPrivilege-based takeover of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) is possible via the Siebel
Full compromise of Oracle Siebel CRM Integration (Open Integration component) is achievable by a low-privileged, network
Privilege escalation to full takeover in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions
Unauthenticated remote compromise of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) is possible throu
Full application takeover in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 throug
Full compromise of Oracle Siebel CRM Integration (Open Integration component) is possible by an unauthenticated remote a
Remote takeover of Oracle Siebel CRM Administration is possible via its Data Archival component, where an unauthenticate
Authentication bypass in the Server Infrastructure component of Oracle Siebel CRM Deployment (supported versions 17.0 th
Authentication bypass in the Server Infrastructure component of Oracle Siebel CRM Deployment (versions 17.0 through 26.7
Unauthenticated attackers with network reachability to the Siebel CRM Open UI SOAP interface can bypass authentication i
Full system takeover in Oracle Siebel CRM Deployment's Server Infrastructure component is achievable by any low-privileg
Full application takeover in Oracle Siebel CRM Cloud Applications (versions 22.3-26.6) is achievable by any low-privileg
Exploit-DB