What is the CVSS score of EUVD-2026-47058?

EUVD-2026-47058 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Oracle Siebel CRM EUVD-2026-47058

| CVE-2026-60709 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-2rv2-px6h-wrwh

Authentication Bypass Oracle Siebel Crm

4.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.2 MEDIUM

AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

4.2 MEDIUM

Adjacent vector and high complexity reflect physical segment requirement and non-trivial exploitation conditions; C:L and I:L match the described partial data read and modification impact with no availability effect.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:55 vuln.today

DescriptionCVE.org

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.5. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel CRM Cloud Applications accessible data as well as unauthorized read access to a subset of Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).

AnalysisAI

Unauthorized data access and manipulation is possible in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.5) via a flaw in the Siebel Cloud Manager component, tagged as an Authentication Bypass. An unauthenticated attacker positioned on the same physical network segment as the hosting hardware can, under high-complexity conditions, read a subset of accessible CRM data and perform unauthorized inserts or modifications. No confirmed active exploitation (CISA KEV) and no public proof-of-concept have been identified at time of analysis, and the CVSS 4.2 score accurately reflects the constrained adjacency and complexity requirements.

Technical ContextAI

The vulnerability resides in the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications, an enterprise customer relationship management platform delivered as a cloud service. The CVSS vector AV:A (Adjacent Network) constrains exploitation to attackers who are on the same physical or logical network segment - such as the same LAN, VLAN, subnet, or broadcast domain - as the hardware where the Siebel workload executes. AC:H (High Complexity) indicates exploitation is not straightforward and likely requires specific network-level conditions, protocol manipulation, or precise timing. No CWE identifier was assigned, but the intelligence tag 'Authentication Bypass' points toward a root cause class consistent with CWE-287 (Improper Authentication) or CWE-306 (Missing Authentication for Critical Function), wherein the Siebel Cloud Manager fails to properly enforce identity verification before granting access to data operations. Affected versions span 22.3 through 26.5, a multi-year release window, broadening the installed base exposed.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update (CPU), referenced at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses this vulnerability. An exact fixed version number was not independently confirmed in the available source data - consult the Oracle CPU July 2026 documentation directly for the precise patched release target. As a compensating control pending patching, enforce strict network segmentation using VLANs or micro-segmentation to isolate the Siebel CRM Cloud Applications hosting environment from shared or untrusted network segments; this directly neutralizes the AV:A attack vector by preventing unauthorized hosts from reaching the physical communication layer. Additionally, implement network-layer access controls such as 802.1X port-based authentication or firewall ACLs on the hosting segment to prevent unauthorized device attachment. These controls reduce attack surface but do not remediate the underlying authentication bypass flaw, so patching via the Oracle CPU remains the definitive fix.