EUVD-2026-61421
GHSA-37ch-jw89-h889
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Siebel Marketing HTTP interface
-
DeliverySend crafted unauthenticated request
-
ExploitBypass authentication
-
ExecutionRead all Marketing data or force crash
-
ImpactData exposure and complete DoS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The only firm prerequisite is network reachability to the Siebel Apps - Marketing HTTP interface of an affected Oracle Siebel CRM instance (versions 17.0-26.6); per CVSS AV:N/AC:L/PR:N/UI:N and the 'Authentication Bypass' tag, no credentials, no special configuration, and no user interaction are required. The primary limiting factor is exposure: if the Marketing web tier is segmented from untrusted networks (internal-only, VPN-gated, or WAF-fronted), an attacker must first gain that network foothold. The specific vulnerable request/endpoint is not disclosed in the available data, so the exact triggering condition beyond 'reach the Marketing HTTP service' is not confirmed. |
| Impact | The signals are strongly aligned toward high priority: the CVSS vector (AV:N/AC:L/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation with no user interaction, and the 'Authentication Bypass' tag reinforces the PR:N rating. Impact is split - high confidentiality (complete read of Marketing data) and high availability (full DoS) with no integrity impact (I:N), which is why the score is 9.1 rather than 10.0. No EPSS score was provided in the input, and the CVE is not in CISA KEV with no POC referenced, so there is currently no evidence of active exploitation; the risk here is driven by exploitability and impact rather than confirmed in-the-wild activity. Because exploitation needs only network reachability to the Marketing HTTP interface, any organization exposing Siebel to untrusted networks should treat this as urgent and apply the August 2026 Oracle CPU promptly, while noting that internal-only deployments have a reduced but non-zero exposure. |
| Exploit ScenarioDerived | An attacker who can reach the Siebel Apps - Marketing web interface over HTTP sends crafted requests that bypass authentication, retrieving all Marketing-accessible data such as customer and campaign records without any credentials or user interaction. The same access can be used to trigger a hang or repeatable crash, taking the Marketing service fully offline. No public proof-of-concept was identified at time of analysis, but the low complexity means exploitation would be straightforward once the request pattern is known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 18, 2026
Unauthenticated remote compromise of Oracle Siebel CRM's Siebel Apps - Marketing component (versions 17.0 through 26.6) allows a network attacker over HTTP to read all Marketing-accessible data and to force a complete, repeatable denial of service. The flaw is rated CVSS 3.1 9.1 and is tagged as an authentication bypass, meaning no credentials are required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of no authentication, low attack complexity, and high confidentiality/availability impact makes it a high-priority patch.
RemediationAI
Apply Oracle's August 2026 Critical Patch Update, which is the vendor-released fix for this issue; Patch available per vendor advisory at https://www.oracle.com/security-alerts/cspuaug2026.html (the input does not specify a discrete fixed build number, so validate the exact patch level for your Siebel release against that advisory before deploying). Until patching is complete, reduce exposure by restricting network access to the Siebel Apps - Marketing HTTP endpoints so they are reachable only from trusted internal networks or via VPN, and place the Siebel web tier behind a WAF or reverse proxy that can filter anomalous requests to the Marketing paths - with the trade-off that overly aggressive filtering may block legitimate campaign or integration traffic. Because the flaw is an unauthenticated bypass, network-level access control is the most reliable compensating control; monitor Siebel web/access logs for unusual unauthenticated requests to Marketing URLs in the interim.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Siebel CRM is a large enterprise customer-relationship-management suite; the affected Marketing module handles campaign, segmentation, and customer-data functions and is typically exposed over HTTP through the Siebel web application layer. Oracle did not assign a CWE (listed as N/A), but the 'Authentication Bypass' tag combined with the C:H/A:H, I:N impact profile points to a flaw that lets a request reach protected data and processing paths without a valid session, rather than a data-tampering or code-integrity issue. Oracle's advisory does not disclose the specific vulnerable code path, which is consistent with Oracle Critical Patch Update practice of withholding technical detail.
Know when Siebel Apps Marketing gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Unauthenticated ('Authentication Bypass'), remote HTTP, no user interaction give AV:N/AC:L/PR:N/UI:N; full data read (C:H) and complete DoS (A:H) with no data tampering (I:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel Apps - Marketing accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel Apps - Marketing. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).
Executive ViewAI
Oracle Siebel CRM Marketing module (versions 17.0-26.6) contains a critical authentication bypass enabling remote attackers to read all marketing data and cause denial of service without any credentials. Organizations using affected versions face immediate exposure of sensitive customer and campaign data combined with operational disruption risk. Given the absence of an available vendor patch, urgent risk mitigation and compensating controls are required.
No vendor-released patch identified at time of analysis. Implement network segmentation restricting Marketing component access to authorized users and systems, deploy rate limiting on HTTP/HTTPS requests to mitigate denial-of-service exploitation, enable comprehensive audit logging of all component access for breach detection, and configure intrusion detection signatures targeting unauthenticated access bypass attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Siebel Apps Marketing
View allWhen using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a)
Remote takeover of Oracle Siebel CRM's Siebel Apps - Marketing component (versions 17.0 through 26.5) is possible by una
Unauthenticated remote takeover of Oracle Siebel Apps - Marketing (versions 17.0 through 26.5) is possible via HTTP, all
Remote unauthenticated takeover of Oracle Siebel Apps - Marketing (versions 17.0 through 26.5) is achievable over HTTP,
Remote unauthenticated takeover of Oracle Siebel Apps - Marketing (versions 17.0 through 26.5) is possible over HTTP, re
Full system takeover in Oracle Siebel CRM's Marketing component is achievable by low-privileged authenticated attackers
Full takeover of Oracle Siebel Apps - Marketing is achievable by any low-privileged attacker with network access via HTT
Authenticated takeover of Oracle Siebel Apps - Marketing (versions 17.0 through 26.5) allows a low-privileged attacker w
Integrity and availability compromise in Oracle Siebel Apps - Marketing (versions 17.0 through 26.6) is reachable by any
Full takeover of Oracle Siebel CRM's Marketing component is achievable by a low-privileged, network-accessible attacker
Local privilege escalation with scope change in Oracle Siebel CRM's Email Marketing component affects versions 17.0 thro
Unauthenticated network exploitation of the Oracle Siebel CRM Marketing component enables critical data theft and unauth
Exploit-DB