EUVD-2026-61369
GHSA-c5jq-rmxq-xhvm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Siebel Cloud Manager over HTTP
-
DeliverySend crafted unauthenticated request
-
ExploitBypass authentication / trigger flaw
-
ExecutionGain control of application
-
ImpactExfiltrate CRM data and disrupt service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network HTTP access to the Siebel Cloud Manager component of Siebel CRM Cloud Applications running any version from 22.3 through 26.6; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special non-default configuration are stated as prerequisites, so a reachable instance is exploitable by an unauthenticated remote attacker. The primary limiting factor is network reachability of the Cloud Manager endpoint - deployments where that management interface is not exposed to untrusted networks are not remotely reachable by external attackers - and the affected-version window bounds exposure to the 22.3-26.6 range. |
| Impact | This scores at the top of the risk band across the signals that are present: the CVSS 3.1 vector is fully network, low-complexity, no-privileges, no-user-interaction with high impact on all three security properties, so any operator running an internet- or intranet-reachable Siebel Cloud Manager should treat this as urgent and patch on Oracle's critical timeline rather than the routine cycle. The signals are not fully corroborated, however: there is no EPSS score in the provided data, no CISA KEV listing, and no public proof-of-concept, so while the theoretical exploitability is maximal, real-world exploitation is unproven at this time. The Oracle-supplied tag 'Information Disclosure' also under-describes the impact, since the description explicitly states full takeover with integrity and availability impact - treat the CVSS vector, not the tag, as authoritative and verify scope against Oracle's advisory. |
| Exploit ScenarioDerived | An attacker who can reach the Siebel Cloud Manager HTTP interface sends a crafted request to a vulnerable endpoint and, without any credentials or user interaction, gains control of the Siebel CRM Cloud Applications instance. From there they can read and exfiltrate customer CRM data, modify records, and disrupt availability. No public proof-of-concept is currently known, so an attacker would need to develop the exploit independently. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 19, 2026
Full application takeover in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 through 26.6, lets a remote unauthenticated attacker fully compromise the system over HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) with a 9.8 base score and full high impact on confidentiality, integrity, and availability marks this as a pre-authentication, network-reachable critical flaw disclosed in Oracle's August 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivially-exploitable, unauthenticated profile makes it a high-priority patch target.
RemediationAI
Apply the fixes in Oracle's August 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspuaug2026.html); this is 'Patch available per vendor advisory' - a specific fixed build number is not enumerated in the provided data, so obtain the exact patch level for your version from that advisory. Until patching, reduce exposure by restricting network reachability of the Siebel Cloud Manager interface: place it behind a VPN or IP allowlist, block untrusted HTTP access at the load balancer or WAF, and remove any internet exposure of the management endpoint, accepting that this may disrupt remote administration and cloud-provisioning workflows that rely on that interface. Increase logging and monitoring on the Cloud Manager HTTP endpoints for anomalous requests as a detective control while the patch is scheduled.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Siebel CRM is Oracle's long-established enterprise customer relationship management suite; the affected component is Siebel Cloud Manager, the management layer for the Cloud Applications deployment model that provisions and administers Siebel environments. Because exploitation occurs over HTTP without authentication and yields takeover, the root cause most plausibly lies in an exposed management/provisioning endpoint that fails to properly authenticate or validate requests, though Oracle's advisory does not disclose the mechanism and the CWE is listed as N/A. Oracle characteristically withholds technical detail in Critical Patch Update entries, so the precise weakness class (e.g., authentication bypass, injection, or deserialization) cannot be confirmed from the available data.
Know when Siebel Crm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description states unauthenticated network HTTP exploitation with full application takeover, giving AV:N/AC:L/PR:N/UI:N and high confidentiality, integrity, and availability impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in takeover of Siebel CRM Cloud Applications. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Siebel CRM systems running versions 22.3-26.6 are vulnerable to remote, unauthenticated compromise of all customer data and operational functions. The vulnerability creates immediate risk of customer data exposure, service outages, and regulatory violations for any organization relying on affected Siebel Cloud Manager deployments.
Restrict network access to Siebel Cloud Manager to authorized administrative networks only using firewall rules or segmentation; deploy Web Application Firewall (WAF) to block exploitation attempts targeting pre-authentication endpoints; implement comprehensive audit logging and real-time alerting for anomalous system access and authentication attempts; consider operational restrictions on non-essential CRM functions until patches are released; establish weekly vulnerability monitoring cadence for Oracle security advisories.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Siebel Crm
View allPrivilege-based takeover of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) is possible via the Siebel
Full compromise of Oracle Siebel CRM Integration (Open Integration component) is achievable by a low-privileged, network
Privilege escalation to full takeover in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions
Unauthenticated remote compromise of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) is possible throu
Full compromise of Oracle Siebel CRM Integration (Open Integration component) is possible by an unauthenticated remote a
Remote takeover of Oracle Siebel CRM Administration is possible via its Data Archival component, where an unauthenticate
Authentication bypass in the Server Infrastructure component of Oracle Siebel CRM Deployment (supported versions 17.0 th
Authentication bypass in the Server Infrastructure component of Oracle Siebel CRM Deployment (versions 17.0 through 26.7
Unauthenticated attackers with network reachability to the Siebel CRM Open UI SOAP interface can bypass authentication i
Full system takeover in Oracle Siebel CRM Deployment's Server Infrastructure component is achievable by any low-privileg
Full application takeover in Oracle Siebel CRM Cloud Applications (versions 22.3-26.6) is achievable by any low-privileg
Siebel Cloud Manager in Oracle Siebel CRM Cloud Applications exposes a network-accessible, low-complexity attack path th
Exploit-DB