EUVD-2026-37238Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Siebel Cloud Manager endpoint
-
DeliveryProbe HTTP interface for vulnerable build
-
ExploitSend crafted request satisfying AC:H preconditions
-
ExecutionBypass authentication on Cloud Manager
-
PersistEscalate to tenant administrative control
-
ImpactExfiltrate or modify CRM data
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must have network HTTP reachability to the Siebel Cloud Manager component of an Oracle Siebel CRM Cloud Applications tenant on a version between 17.0 and 26.5; no authentication and no user interaction are required per CVSS PR:N/UI:N. Exploitation is rate-limited by Oracle's AC:H rating, which indicates the attack depends on conditions outside the attacker's direct control - for example, race windows, specific tenant configuration, or precise request timing - so casual scanning is unlikely to succeed without targeted preparation. On-premises Siebel CRM deployments are NOT in scope; only the cloud-hosted Cloud Manager surface is affected. |
| Impact | The CVSS 3.1 base score of 8.1 reflects strong impact (C:H/I:H/A:H) but is tempered by AC:H, meaning Oracle considers exploitation to require uncommon conditions, specialized knowledge, or non-default state - this is a meaningful brake on opportunistic mass exploitation. There is no EPSS score, KEV listing, SSVC decision, or public POC reflected in the provided data, so real-world exploitation pressure currently appears low despite the headline severity. The combination of PR:N (no authentication) with a managed cloud product is notable: Oracle hosts the affected systems, so customers cannot patch independently, and remediation depends on Oracle's coordinated CPU rollout rather than tenant action. Treat this as 'high theoretical impact, currently low observed exploitation,' but monitor for KEV/PoC updates given the takeover potential. |
| Exploit ScenarioDerived | An internet-based attacker who has identified a target tenant's Siebel Cloud Manager HTTP endpoint sends a series of crafted requests that satisfy the non-trivial preconditions Oracle flags as AC:H, bypassing authentication on the Cloud Manager. Once the management plane accepts the request, the attacker pivots to take over the Siebel CRM tenant - reading customer PII, modifying CRM records, or disabling the service. No public exploit is currently available, so weaponization would require independent vulnerability research against the Oracle CPU advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Full takeover of Oracle Siebel CRM Cloud Applications (versions 17.0-26.5) is possible by unauthenticated remote attackers reaching the Siebel Cloud Manager component over HTTP, though Oracle classifies exploitation as difficult (AC:H). Successful attacks yield high impact across confidentiality, integrity, and availability - effectively complete compromise of the CRM tenant. No public exploit identified at time of analysis, and the issue is not on the CISA KEV list.
RemediationAI
Patch available per vendor advisory - apply the fixes bundled in the Oracle Critical Patch Update of June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html); because this is a cloud-hosted product, Oracle deploys the fix to tenants, but customers should confirm patch status with Oracle Support and validate post-patch behavior in non-production tenants first. Until rollout is confirmed, restrict network exposure of any customer-managed integration endpoints by enforcing IP allow-listing in Oracle Cloud Infrastructure WAF or perimeter controls, require VPN/Zero-Trust gateways in front of Siebel UI/API access, and monitor Cloud Manager logs for unexpected administrative actions - note that aggressive IP restriction can break legitimate partner integrations and remote field-force access, so coordinate with business owners.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in the Siebel Cloud Manager component of Oracle's Siebel CRM Cloud Applications, the SaaS-delivered variant of Oracle's long-running customer relationship management suite used heavily by enterprises in financial services, telco, and the public sector. The CPE (cpe:2.3:a:oracle_corporation:siebel_crm_cloud_applications) confirms the cloud-hosted edition rather than on-premises Siebel deployments, and the affected range spans Siebel Innovation Pack 17.0 through the 26.5 release line. No CWE has been assigned by Oracle, but the network-reachable HTTP attack surface combined with full CIA impact and 'takeover' wording is consistent with an authentication bypass or remote logic flaw in the Cloud Manager's web-facing management interface rather than memory corruption.
Know when Siebel Crm Cloud Applications gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
HTTP-reachable Cloud Manager with no auth or UI required (AV:N/PR:N/UI:N); Oracle flags difficult preconditions (AC:H); full tenant takeover gives C:H/I:H/A:H within the same security authority (S:U).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 17.0-26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in takeover of Siebel CRM Cloud Applications. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Siebel CRM Cloud Applications (versions 17.0-26.5) contain a critical vulnerability allowing unauthenticated remote attackers to achieve complete compromise of affected CRM tenants, exposing customer data and disrupting business operations. While active exploitation has not been documented and the attack requires sophisticated technical execution, the lack of an available patch and the sensitivity of CRM systems require immediate defensive action to restrict access and prevent future exploitation.
Restrict unauthenticated network access to Siebel Cloud Manager component using IP whitelisting and VPN enforcement; deploy Web Application Firewall (WAF) rules blocking unauthenticated requests to vulnerable endpoints; implement comprehensive logging and real-time alerting for anomalous Cloud Manager activity; enforce principle of least privilege for all Cloud Manager access; segment Siebel infrastructure from other critical systems.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote takeover of Oracle Siebel CRM Cloud Applications (versions 17.0 through 26.5) allows unauthenticated network atta
Account takeover in Oracle Siebel CRM Cloud Applications versions 17.0 through 26.5 allows a low-privileged remote attac
Privilege escalation and full takeover of Oracle Siebel CRM Cloud Applications (versions 17.0 through 26.5) is possible
Adjacent-network takeover of Oracle Siebel CRM Cloud Applications (versions 17.0 through 26.5) is possible via the Siebe
Denial-of-service in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3 through 26.5) a
GitHub PoC
Exploit-DB