Siebel Crm
Monthly
High-privileged attackers who can reach Oracle Siebel CRM's Deployment Server Infrastructure over HTTP can create, delete, or modify critical data and read all data accessible through that component, with the scope change (S:C) meaning successful exploitation can also affect other connected Oracle products beyond Siebel CRM. Supported releases 17.0 through 26.9 are affected; Oracle rates the flaw CVSS 3.1 8.7 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N), with confidentiality and integrity fully compromised but no availability impact. The pre-existing administrative privilege requirement (PR:H) is the principal limiting factor, making malicious insiders or already-compromised admin accounts the realistic threat actors; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Unauthenticated network attackers can take over Oracle Siebel CRM Development versions 17.0 through 26.9 through the Siebel Approval Manager component, but only if a targeted user is tricked into interacting with attacker-supplied content over HTTP. The CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting high confidentiality, integrity, and availability impact gated by mandatory user interaction. No public exploit code or confirmed active exploitation is identified in the available intelligence at time of analysis.
Unauthenticated remote denial of service in the Siebel CRM Deployment component (Server Infrastructure) of Oracle Siebel CRM affects supported releases 17.0 through 26.7, allowing any attacker with TCP network access to drive the Deployment service into a hang or frequently repeatable crash. Oracle rates the flaw CVSS 7.5 with a fully remote, low-complexity, no-privilege, no-interaction vector (AV:N/AC:L/PR:N/UI:N) but availability-only impact (C:N/I:N/A:H), meaning confidentiality and integrity of CRM data are not directly at risk. No public exploit code has been identified and the issue does not appear in CISA KEV, though Oracle's own advisory language describes it as 'easily exploitable', so exposure should be treated as urgent for internet- or WAN-reachable deployment instances.
Unauthenticated remote denial of service in Oracle Siebel CRM Deployment (Server Infrastructure component) affects all supported releases from 17.0 through 26.7 and lets any attacker who can reach the deployment service over TCP hang or repeatedly crash it, with CVSS 3.1 scored 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only). Because the flaw needs no credentials, no user interaction, and no special conditions, any internet- or WAN-exposed deployment endpoint is at risk of sustained outage, though impact is limited to availability. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; Oracle's CPU-style advisory at https://www.oracle.com/security-alerts/cspusep2026.html is the authoritative source.
Unauthenticated denial of service against Oracle Siebel CRM Deployment (Server Infrastructure component) lets network-reachable attackers hang or repeatedly crash the service, taking the deployment offline; affected releases span 17.0 through 26.7. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U, availability-only impact), meaning no credentials, no user interaction, and no special complexity are required — a low bar for automation. No public exploit code or CISA KEV listing was identified in the supplied intelligence at time of analysis, so the immediate concern is exposure management rather than confirmed active exploitation.
Authentication bypass in the Server Infrastructure component of Oracle Siebel CRM Deployment (supported versions 17.0 through 26.7) lets an unauthenticated remote attacker reach the HTTP interface and take full read/write control of deployment data. The assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (score 9.1) confirms no credentials, no user interaction, and no non-default configuration are required; impact is confined to confidentiality and integrity, so data can be stolen or tampered with but the service cannot be disrupted (A:N). No public exploit code has been identified at time of analysis and CISA SSVC rates exploitation as 'none', though the flaw is rated automatable with total technical impact - making exposure reduction the key control while patching.
Authentication bypass in the Server Infrastructure component of Oracle Siebel CRM Deployment (versions 17.0 through 26.7) lets an unauthenticated remote attacker reach critical CRM data over HTTP and read, create, delete, or modify it at will. Rated CVSS 3.1 base 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and classified CWE-287, the flaw requires no credentials and no user interaction - the only meaningful barrier is network reachability of the Siebel HTTP interface. No public exploit code exists and there is no confirmed active exploitation (CISA SSVC exploitation: none), but the issue is assessed as automatable with total technical impact, so exposure should be treated as urgent for internet-facing deployments; EPSS data was not provided for this CVE.
Unauthenticated denial of service in Oracle Siebel CRM Deployment (Server Infrastructure component) affecting release levels 17.0 through 26.7. An attacker who can reach the deployment infrastructure over HTTP can send crafted requests that hang or repeatedly crash the service, producing a complete denial of service with no confidentiality or integrity impact. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied; the risk is driven by the low attack complexity and lack of required credentials rather than by observed exploitation.
Unauthenticated attackers with network reachability to the Siebel CRM Open UI SOAP interface can bypass authentication in Oracle Siebel CRM End User versions 17.0 through 26.7 and obtain full read, create, modify, and delete access to all data reachable through the affected component. Rated CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), the flaw requires no credentials, no user interaction, and has low attack complexity, though it carries no availability impact (A:N). No public exploit code and no confirmed active exploitation were identified at time of analysis, so the primary real-world risk driver is whether the SOAP endpoint of a given deployment is exposed beyond trusted networks.
Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 expose a flaw in the Siebel Cloud Manager component that lets an attacker already holding a low-privileged account on the platform, and positioned on the same physical/adjacent network segment as the hosting hardware, read essentially all CRM data, modify or delete some of it, and partially disrupt service. The CVSS 3.1 base score is 8.2 (AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L), and the scope-change metric indicates the compromise can spill over into additional products beyond Siebel itself. No public exploit code has been identified and the issue is not listed in CISA KEV, but it should not be ignored: the confidentiality impact is total, Oracle rates exploitability as 'easily exploitable', and no EPSS score or CWE mapping was supplied to further refine the risk picture.
Unauthenticated attackers who can reach the HTTP interface of Oracle Siebel CRM Cloud Applications, specifically the Siebel Cloud Manager component, can bypass authentication and gain full read access to critical CRM data plus limited ability to insert, update or delete records. The flaw affects supported releases 22.3 through 26.7 and carries a CVSS 3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N, C:H/I:L/A:N), meaning it is remotely reachable, low complexity and requires no credentials or user interaction. No public exploit code or CISA KEV listing was present in the supplied intelligence, so exploitation status is unconfirmed at time of analysis.
Unauthenticated attackers with HTTP network access can read critical data from Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 by exploiting an authentication bypass in the Siebel Cloud Manager component. The flaw is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) with high confidentiality impact only - integrity and availability are unaffected - meaning a successful hit exposes all data reachable through the affected component. No public exploit code, EPSS score, or CISA KEV entry was supplied in the intelligence feed, so active exploitation is currently unconfirmed.
Unauthenticated attackers with network reachability to the SSH interface of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.7) can bypass authentication and gain unauthorized access to critical CRM data through the Siebel Cloud Manager component. Oracle scores the flaw 8.6 with a scope change, meaning a successful compromise can extend beyond the Siebel deployment to affect additional products. No public exploit code, EPSS score, or CISA KEV entry was provided at the time of analysis, although the low-complexity, no-credentials attack profile makes rapid weaponization plausible.
Local privilege escalation in the Installation component of Oracle Siebel CRM Deployment (supported versions 17.0 through 26.7) lets any low-privileged user who can log on to the host running Siebel CRM Deployment to fully compromise that deployment. Because the flaw is reachable through the local attack surface with no user interaction and yields complete loss of confidentiality, integrity and availability, an attacker with an otherwise ordinary account can effectively take over the CRM environment. No public exploit code or in-the-wild exploitation is identified in the available intelligence at time of analysis, and the vendor advisory from Oracle is the sole reference for affected versions and fixes.
Full system takeover is achievable in Oracle Siebel CRM End User versions 17.0 through 26.6 via the Document Management component over HTTP, exploitable by any low-privileged authenticated user without user interaction. The CVSS 8.8 score reflects complete confidentiality, integrity, and availability impact, consistent with the vendor's characterization of 'takeover' of the End User instance. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range make this a priority patching target for any organization running affected Siebel deployments.
Full system takeover in Oracle Siebel CRM Deployment's Server Infrastructure component is achievable by any low-privileged attacker with network HTTP access, affecting versions 17.0 through 26.6. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms exploitation is straightforward - no elevated privileges, no user interaction, and low complexity - resulting in complete compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low barrier to exploitation makes this a high-priority patching target for organizations running affected Siebel deployments.
Unauthenticated remote data exposure in Oracle Siebel CRM Integration's REST component allows network attackers to read all CRM-accessible data without credentials across versions 17.0 through 26.6. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is exploitable with no authentication and minimal attack complexity, yielding complete confidentiality loss. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Full takeover of Oracle Siebel CRM Integration (versions 17.0-26.6) is achievable by a low-privileged authenticated attacker over HTTP, exploiting a flaw in the REST component. The CVSS scope change (S:C) means successful exploitation can pivot beyond the directly targeted service, potentially compromising additional Oracle or backend systems. No public exploit has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog; however, the C:H/I:H/A:H impact triad warrants prioritized patching for organizations running Siebel in enterprise environments.
Oracle Siebel CRM End User versions 17.0 through 26.6 expose a network-exploitable flaw in the Open UI component that, when triggered via a crafted HTTPS interaction, grants a low-privileged attacker full read and write access to critical CRM data - including complete confidentiality and integrity compromise with a documented scope change to additional products. The 'Authentication Bypass' tag reported by Oracle's security team suggests the Open UI layer can be manipulated to circumvent access controls in the context of an authenticated victim's session. No exploit code is publicly available and the vulnerability is not listed in the CISA KEV catalog at the time of analysis.
Full system takeover of Oracle Siebel CRM Deployment (versions 17.0 through 26.6) is achievable by unauthenticated remote attackers via HTTP, targeting the Migration component. The attack requires human interaction from a victim - a social engineering or luring condition that constrains opportunistic exploitation - but successful exploitation results in complete compromise of confidentiality, integrity, and availability of the Siebel CRM Deployment instance. No public exploit code has been identified at time of analysis, and this vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog.
Unauthorized data access in Oracle Siebel CRM Integration versions 25.12 through 26.6 allows low-privileged network attackers to read all CRM-accessible data and perform limited data manipulation via HTTP against the Open Integration component, with a confirmed scope change extending impact to additional integrated products. The vulnerability is tagged by Oracle as an Authentication Bypass, enabling a valid but low-privileged account to exceed its authorized access boundaries without elevated complexity or user interaction. No public exploit has been identified at time of analysis, but the combination of low attack complexity, network accessibility, and scope change makes this a credible high-priority threat in enterprise Siebel deployments.
Oracle Siebel CRM Integration versions 25.12-26.6 exposes a high-severity authentication bypass in its Open Integration component that permits an unauthenticated attacker on the same physical network segment to fully read and modify all data accessible through the integration layer. The CVSS 8.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) confirms low-complexity, credential-free exploitation, though the adjacent-network requirement materially constrains the attacker population to insiders or laterally-moved threat actors. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Integrity and availability compromise in Oracle Siebel CRM Integration's Open Integration component (versions 25.12 through 26.6) allows a high-privileged remote attacker over HTTP to corrupt or destroy critical data and trigger a complete denial of service, with confirmed scope change meaning successful exploitation may cascade into additional integrated downstream products. The attack requires high complexity and pre-existing administrative privileges, limiting opportunistic exploitation, but the cross-system blast radius elevates overall business risk. No public exploit code has been identified and this vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Unauthorized data disclosure in Oracle Siebel CRM Integration (versions 25.12 through 26.6) allows a low-privileged authenticated attacker to access critical or complete CRM data via HTTP by exploiting an authentication bypass in the Open Integration component. The scope change (S:C) in the CVSS vector means successful exploitation can extend data exposure beyond Siebel CRM Integration to additional integrated Oracle products. No public exploit code or CISA KEV listing exists at time of analysis, but the low attack complexity and no user-interaction requirement make this readily actionable for any attacker holding even minimal valid credentials.
Full compromise of Oracle Siebel CRM Integration (Open Integration component) is possible by an unauthenticated remote attacker over HTTP, per Oracle's August 2026 Critical Patch Update. Affected releases span Siebel CRM Integration 25.12 through 26.6, and successful exploitation yields complete takeover of the Integration component with full confidentiality, integrity, and availability impact (CVSS 9.8). No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the unauthenticated, low-complexity network profile makes it a high-priority patch item.
Remote authentication bypass in Oracle Siebel CRM Integration (Open Integration component, versions 25.12-26.6) allows unauthenticated network attackers via HTTP to achieve full confidentiality and integrity compromise of CRM data when a victim user interacts with attacker-controlled content. The vulnerability enables unauthorized read, create, delete, and modification access to all Siebel CRM Integration accessible data. Tagged as an Authentication Bypass by Oracle and scored CVSS 8.1 (High), no public exploit code or CISA KEV listing has been identified at time of analysis.
Siebel CRM Integration versions 25.12 through 26.6 expose a network-exploitable flaw in the Open Integration component that permits a low-privileged attacker to achieve full system takeover via crafted HTTP requests under high-complexity conditions. The CVSS 3.1 score of 8.5 reflects a scope change (S:C) alongside full confidentiality, integrity, and availability impact, meaning successful exploitation can cascade to other Oracle and third-party systems connected through the integration layer. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed the issue in the August 2026 Critical Security Patch Update.
Authentication bypass in Oracle Siebel CRM Integration (Open Integration component, versions 25.12-26.6) allows a remote unauthenticated attacker reachable over HTTP to gain unauthorized read and write access to critical CRM data, with a confirmed scope change meaning successful exploitation can cascade to impact additional integrated systems beyond Siebel itself. The AC:H rating indicates exploitation is difficult and likely requires meeting specific environmental or timing conditions, tempering the urgency implied by the 8.7 CVSS score. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Full compromise of Oracle Siebel CRM Integration (Open Integration component) is achievable by a low-privileged, network-based attacker over HTTP, with a scope change that lets attacks significantly impact additional products beyond the vulnerable component. Affected releases span 25.12 through 26.6, and Oracle rates it CVSS 3.1 9.9 with full confidentiality, integrity, and availability loss (component takeover). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of low attack complexity, low privilege requirement, and scope change makes it a top-tier patch priority.
Unauthorized data access and partial data manipulation in Oracle Siebel CRM's Data Archival component exposes critical CRM data to low-privileged network attackers via HTTP. Affected versions 25.12 through 26.6 allow an authenticated low-privileged user to gain complete read access to all Siebel CRM Administration accessible data and perform unauthorized write operations on a subset of that data. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though the 'Authentication Bypass' tag suggests the flaw enables privilege escalation beyond the attacker's authorized scope within the application.
Unauthenticated network exploitation of the Data Archival component in Oracle Siebel CRM Administration exposes complete CRM data to unauthorized access over HTTP. Affecting versions 25.12 through 26.6, the vulnerability carries a CVSS 3.1 score of 8.6 with a confirmed scope change, meaning successful exploitation can cascade to impact additional Oracle or integrated enterprise products beyond the Siebel CRM Administration interface itself. No public exploit or CISA KEV listing has been identified at time of analysis, but the zero-authentication, low-complexity attack surface makes this a high-priority patching target for any organization with internet-exposed Siebel administrative interfaces.
Remote takeover of Oracle Siebel CRM Administration is possible via its Data Archival component, where an unauthenticated attacker with only HTTP network access can fully compromise the module. Oracle rates this CVSS 9.8 with high confidentiality, integrity, and availability impact, and it was disclosed in the August 2026 Oracle Critical Patch Update. At time of analysis there is no public exploit identified and no CISA KEV listing, but the trivial exploitability (AV:N/AC:L/PR:N/UI:N) makes it a high-priority patch for Siebel operators.
Privilege escalation to full takeover in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3 through 26.6) lets a low-privileged attacker with only HTTP network access fully compromise the application and, because of a scope change, meaningfully impact additional connected products. Oracle rates it CVSS 3.1 9.9 with high confidentiality, integrity, and availability impact; it was disclosed in the Oracle Critical Patch Update of August 2026. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Compromise of Oracle Siebel CRM Cloud Applications (versions 22.3-26.6) is achievable by a low-privileged, network-authenticated attacker over HTTP targeting the Siebel Cloud Manager component. Successful exploitation yields unauthorized creation, deletion, or modification of critical CRM data (high integrity impact), partial unauthorized read of CRM data (low confidentiality impact), and the ability to cause a complete, repeatable denial-of-service crash of the application. No public exploit code and no CISA KEV listing are confirmed at time of analysis; EPSS data was not supplied in the source intelligence.
Local privilege escalation in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) enables a low-privileged attacker with logon access to the hosting infrastructure to fully compromise the application via the Siebel Cloud Manager component. Successful exploitation results in complete application takeover with high confidentiality, integrity, and availability impacts. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated remote compromise of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) is possible through the Siebel Cloud Manager component via crafted HTTP requests, requiring no privileges or user interaction. An attacker can gain full read access to all Siebel CRM Cloud data, perform limited unauthorized writes, and cause a partial denial of service, and because the flaw carries a scope change, exploitation can significantly impact additional connected products beyond Siebel itself. Rated CVSS 9.9; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated adjacent-network exploitation of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) via the Siebel Cloud Manager component allows complete read and write access to all CRM data without credentials. The CVSS vector (AV:A/AC:L/PR:N/UI:N) confirms low-complexity, zero-authentication exploitation, constrained only by the requirement for physical or logical adjacency to the target network segment. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the authentication bypass tag and high integrity/confidentiality impact make this a serious concern for any environment with exposed CRM infrastructure.
Full application takeover in Oracle Siebel CRM Cloud Applications (versions 22.3-26.6) is achievable by any low-privileged, network-accessible attacker via HTTP against the Siebel Cloud Manager component, with no user interaction required. Oracle classifies this as 'easily exploitable' and the CVSS vector confirms high impact across confidentiality, integrity, and availability - consistent with a complete system compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range across four years of releases materially raises real-world risk for unpatched enterprise deployments.
Local privilege abuse in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) allows a low-privileged OS-level user on the hosting infrastructure to compromise the Siebel Cloud Manager component, achieving full read access to all CRM application data and limited write access, with a confirmed scope change extending impact to additional co-hosted products. The attack vector is local infrastructure access, making this primarily an insider threat or post-compromise lateral movement risk rather than an external internet-facing exposure. No public exploit has been identified, and Oracle addressed this vulnerability in the August 2026 Critical Patch Update (CPU Aug 2026).
High-privileged remote exploitation of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) via the Siebel Cloud Manager component enables full confidentiality and integrity compromise of Siebel data, with a documented scope change allowing cascading impact on additional Oracle products in the environment. Oracle's August 2026 Critical Security Patch Update discloses a CVSS 3.1 base score of 8.7, reflecting network-accessible exploitation requiring no interaction but demanding high-privilege credentials. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Siebel Cloud Manager in Oracle Siebel CRM Cloud Applications exposes a network-accessible, low-complexity attack path that allows any low-privileged authenticated user to fully take over the application via HTTP. Affected versions span 22.3 through 26.6, a multi-year range covering a substantial portion of the deployed base. No public exploit has been identified at time of analysis; however, Oracle's own characterization of this as 'easily exploitable' and the complete C/I/A impact make this a high-priority remediation target from the August 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3-26.6) allows a low-privileged, network-authenticated attacker to read the entirety of accessible CRM data and perform limited unauthorized data writes via standard HTTP requests. The vulnerability carries a confirmed scope change, meaning successful exploitation of the Siebel Cloud Manager component can cascade to compromise data in additional integrated Oracle products beyond the initial target. No public exploit code has been identified at time of analysis, but the low attack complexity combined with only a low-privilege requirement makes this a realistic and urgent patching priority for any organization running a Siebel CRM Cloud deployment.
Unauthorized data access and manipulation in Oracle Siebel CRM Cloud Applications (versions 22.3-26.6) is achievable by low-privileged, network-connected attackers via HTTP against the Siebel Cloud Manager component. Successful exploitation grants complete read access to all CRM data and the ability to create, delete, or modify critical records, with no availability disruption to the service itself. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low attack complexity and low privilege requirement lower the bar for a targeted threat actor with valid credentials.
Full application takeover in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 through 26.6, lets a remote unauthenticated attacker fully compromise the system over HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) with a 9.8 base score and full high impact on confidentiality, integrity, and availability marks this as a pre-authentication, network-reachable critical flaw disclosed in Oracle's August 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivially-exploitable, unauthenticated profile makes it a high-priority patch target.
Privilege-based takeover of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) is possible via the Siebel Cloud Manager component, where a low-privileged attacker with HTTP network access can fully compromise the application. Because the flaw carries a scope change, successful attacks can significantly impact additional connected products beyond Siebel itself. Rated CVSS 3.1 9.9 with full confidentiality, integrity, and availability impact; no public exploit identified at time of analysis.
Unauthenticated remote exploitation of Oracle Siebel CRM Integration's REST component across versions 17.0 through 26.6 can yield complete loss of data confidentiality and integrity. Tagged as an authentication bypass, the vulnerability permits network-accessible attackers to read all CRM data and perform unauthorized create, delete, or modify operations without credentials. No public exploit has been identified at time of analysis, and Oracle's August 2026 Critical Patch Update addresses the issue.
Unauthorized access to critical CRM data and partial data manipulation in Oracle Siebel CRM Deployment (versions 17.0-26.6) is achievable via the Migration component by any low-privileged attacker with HTTP network access, with a documented scope change indicating that successful exploitation can cascade to affect additional Oracle products beyond the directly targeted component. The CVSS 3.1 base score of 8.5 reflects low attack complexity and no user interaction requirement, making exploitation straightforward for any holder of a valid low-privilege credential. No public exploit has been identified at time of analysis and no CISA KEV listing exists, though the breadth of affected versions spanning nearly a decade of releases represents substantial organizational exposure.
Oracle Siebel CRM Integration's REST component (versions 17.0 through 26.6) contains an authentication bypass flaw enabling unauthenticated network attackers to fully compromise data confidentiality and integrity over HTTPS. The 'Authentication Bypass' tag from the Oracle reporter confirms the vulnerability class: an attacker who satisfies the high-complexity exploitation condition can read all CRM data and perform unauthorized creation, modification, or deletion of records. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog at time of analysis.
Unauthenticated remote access to Oracle Siebel CRM Integration's REST component (versions 17.0 through 26.6) exposes all CRM integration data to unauthorized disclosure and enables partial denial of service via plain HTTP. The vulnerability requires no credentials, no user interaction, and no special configuration beyond the REST interface being reachable, making it exploitable by any network-adjacent or internet-facing attacker. No public exploit has been identified at time of analysis, but Oracle's Critical Patch Update for August 2026 confirms the issue and its severity classification of CVSS 8.2.
Oracle Siebel CRM Deployment's Server Infrastructure component exposes versions 17.0 through 26.6 to an unauthenticated, network-based authentication bypass over HTTP that can result in complete compromise of CRM data confidentiality and integrity. The high complexity rating (AC:H) tempers immediate mass-exploitation risk, but the Authentication Bypass tag combined with C:H and I:H impact means a successful attacker achieves full read and write access to all CRM-accessible data - including customer records, sales pipelines, and service data - without presenting valid credentials. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle's Critical Security Patch Update for August 2026 addresses this vulnerability.
Oracle Siebel CRM Deployment's Application Interface component (versions 17.0 through 26.6) exposes complete read and write access to all CRM data to unauthenticated attackers positioned on the adjacent network segment. The CVSS vector confirms zero authentication requirements and low attack complexity, meaning any actor with access to the physical communication segment hosting the Siebel server can silently exfiltrate or corrupt the entire CRM dataset. No active exploitation has been confirmed in the CISA KEV catalog and no public exploit code has been identified at time of analysis, but the authentication bypass classification combined with high confidentiality and integrity impact makes this a credible priority for organizations with insufficiently segmented internal networks.
Remote authentication bypass in Oracle Siebel CRM Integration's REST component affects all supported versions from 17.0 through 26.6, enabling unauthenticated network attackers to achieve full read and write access to critical CRM data via crafted HTTPS requests. The vulnerability is tagged Authentication Bypass, indicating that REST API access controls can be circumvented without credentials despite a high attack complexity (AC:H) rating that suggests exploitation requires precise crafting or internal state knowledge. No public exploit identified at time of analysis, but the combination of unauthenticated access and high confidentiality and integrity impact warrants priority patching under Oracle's August 2026 Critical Patch Update.
Unauthenticated adjacent-network exploitation of Oracle Siebel CRM's Search component allows complete read and write access to all CRM data across versions 17.0 through 26.6. Successful exploitation enables creation, deletion, and modification of critical data as well as full confidentiality compromise without any prior authentication or user interaction. No public exploit identified at time of analysis, and this vulnerability is not currently listed in CISA KEV, though its low-complexity, unauthenticated nature makes it a credible priority for organizations with exposed Siebel deployments.
Unauthorized data access in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 through 26.5, lets an unauthenticated remote attacker over HTTP read all Siebel-accessible data, tamper with some records, and cause a partial denial of service. Oracle rates it CVSS 7.0 but flags it as difficult to exploit (AC:H), and no public exploit identified at time of analysis. Disclosed via the Oracle July 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 through 26.5, lets a remote unauthenticated attacker reach sensitive data over HTTP. The flaw is tagged as an authentication bypass and, per Oracle's own scoring, is 'easily exploitable' with a high confidentiality impact but no integrity or availability effect (CVSS 3.1 base 7.5). No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided in the source data.
Unauthorized data access in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3 through 26.5) allows a low-privileged attacker with network HTTP access to read all data accessible to the application. Oracle rates it CVSS 3.1 7.7 with a scope change, and the ENISA EUVD flags an authentication-bypass characteristic, meaning a minimally-authenticated actor can escalate to broad confidentiality compromise that spills into additional connected products. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data access in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3 through 26.5) lets a remote, unauthenticated attacker reach and read critical application data over HTTP. Oracle rates this CVSS 3.1 7.5 with confidentiality-only impact, and the intelligence tags flag it as an authentication-bypass class issue, so attackers can obtain complete access to all data accessible to the affected applications without credentials. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.9 can be taken over by an attacker who already holds a high-privileged account and has interactive logon access to the infrastructure host where the component executes. The issue is rated CVSS 3.1 base 6.7 with high confidentiality, integrity, and availability impact, but the local attack vector (AV:L) and high-privilege prerequisite (PR:H) sharply constrain the realistic attacker population to insiders or actors who already have a foothold. No public exploit identified at time of analysis; no CISA KEV entry is present in the provided data.
Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 through 26.7, permits low-privileged authenticated users with HTTP network access to reach functionality they should not control, enabling unauthorized read and modification of data and affecting systems beyond the vulnerable component (scope change). The flaw is rated CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting an easily automated but credential-gated attack with limited confidentiality and integrity impact. No public exploit code or CISA KEV entry is identified at time of analysis, and no CWE classification was assigned by the reporting source.
Oracle Siebel CRM Deployment (Cloud Gateway component) versions 17.0 through 26.7 contains a hard-to-exploit flaw that lets a low-privileged attacker with HTTP network access read and modify critical CRM data, with Oracle rating both confidentiality and integrity impact as High. The vendor advisory does not disclose the root cause, and no public exploit code, EPSS score, or CISA KEV entry was supplied with this record, so real-world exploitation is unconfirmed. The associated 'Authentication Bypass' tag is not corroborated by the Oracle text, which describes unauthorized data creation, deletion, and modification rather than an explicit credential-check bypass.
Unauthorized data access and manipulation is possible in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.5) via a flaw in the Siebel Cloud Manager component, tagged as an Authentication Bypass. An unauthenticated attacker positioned on the same physical network segment as the hosting hardware can, under high-complexity conditions, read a subset of accessible CRM data and perform unauthorized inserts or modifications. No confirmed active exploitation (CISA KEV) and no public proof-of-concept have been identified at time of analysis, and the CVSS 4.2 score accurately reflects the constrained adjacency and complexity requirements.
Unauthorized data manipulation via authentication bypass in Oracle Siebel CRM Integration's Siebel Server Sync for Exchange component allows unauthenticated remote attackers to insert, update, or delete a subset of CRM-accessible data over HTTP. All versions from 17.0 through 26.5 are affected, with exploitation constrained by high attack complexity that substantially reduces real-world risk. No public exploit code or active exploitation has been identified at time of analysis, consistent with the low CVSS score of 3.7 reflecting limited, integrity-only impact.
Unauthenticated information disclosure in Oracle Siebel CRM's End User User Interface component allows remote attackers to read a subset of CRM data over HTTP without credentials. Versions 25.0 through 25.5 are confirmed affected. Oracle has released a fix in the July 2025 Critical Patch Update; no public exploit or active exploitation has been identified at time of analysis.
Vulnerability in the Siebel CRM product of Oracle Siebel CRM (component: UI Framework). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the Siebel CRM product of Oracle Siebel CRM (component: Siebel Core - Server Infrastructure). Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Vulnerability in the Siebel Core - DB Deployment and Configuration product of Oracle Siebel CRM (component: Install - Configuration). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Siebel Core - Server BizLogic Script component of Oracle Siebel CRM (subcomponent: Integration - Scripting). Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, low attack complexity.
Unspecified vulnerability in the Siebel Core - Server Framework component in Oracle Siebel CRM IP2014 and IP2015 allows remote attackers to affect confidentiality via unknown vectors related to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1, 8.22, and 15.0 allows remote authenticated users to affect confidentiality via vectors related to UIF Open. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable.
Unspecified vulnerability in the Siebel Core - Server OM Svcs component in Oracle Siebel CRM 8.1.1, 8.2.2, and 15.0 allows remote attackers to affect confidentiality via vectors related to LDAP. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Unspecified vulnerability in the Siebel Core - Server OM Svcs component in Oracle Siebel CRM 8.1.1, 8.2.2, and 15.0 allows remote authenticated users to affect confidentiality via unknown vectors. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1, 8.2.2, and 15.0 allows remote attackers to affect integrity via vectors related to SWSE Server. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1 and 8.2 allows remote attackers to affect integrity via unknown vectors related to Portal Framework. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Oracle Enterprise Asset Management component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Portal Framework,. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Portal. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity.
Unspecified vulnerability in the Siebel Core - Server BizLogic Script component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect integrity via vectors related to Integration -. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Unspecified vulnerability in the Siebel Life Sciences component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unspecified vulnerability in the Siebel Core - Server BizLogic Script component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality, integrity, and. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Portal. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unspecified vulnerability in the Siebel Core - Server OM Services component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via vectors related to. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unspecified vulnerability in the Siebel Public Sector component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect integrity via unknown vectors related to Public Sector. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect integrity via unknown vectors related to AX/HI Web UI. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel Core - EAI component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Java Integration, a. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity.
Unspecified vulnerability in the Siebel Core - Server Infrastructure component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel Core - EAI component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect availability via unknown vectors related to Integration. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel Core EAI component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect availability via unknown vectors related to Integration. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unspecified vulnerability in the Siebel Core - Common Components component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect integrity via unknown vectors related to Portal Framework. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel Core - System Management component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity.
High-privileged attackers who can reach Oracle Siebel CRM's Deployment Server Infrastructure over HTTP can create, delete, or modify critical data and read all data accessible through that component, with the scope change (S:C) meaning successful exploitation can also affect other connected Oracle products beyond Siebel CRM. Supported releases 17.0 through 26.9 are affected; Oracle rates the flaw CVSS 3.1 8.7 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N), with confidentiality and integrity fully compromised but no availability impact. The pre-existing administrative privilege requirement (PR:H) is the principal limiting factor, making malicious insiders or already-compromised admin accounts the realistic threat actors; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Unauthenticated network attackers can take over Oracle Siebel CRM Development versions 17.0 through 26.9 through the Siebel Approval Manager component, but only if a targeted user is tricked into interacting with attacker-supplied content over HTTP. The CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting high confidentiality, integrity, and availability impact gated by mandatory user interaction. No public exploit code or confirmed active exploitation is identified in the available intelligence at time of analysis.
Unauthenticated remote denial of service in the Siebel CRM Deployment component (Server Infrastructure) of Oracle Siebel CRM affects supported releases 17.0 through 26.7, allowing any attacker with TCP network access to drive the Deployment service into a hang or frequently repeatable crash. Oracle rates the flaw CVSS 7.5 with a fully remote, low-complexity, no-privilege, no-interaction vector (AV:N/AC:L/PR:N/UI:N) but availability-only impact (C:N/I:N/A:H), meaning confidentiality and integrity of CRM data are not directly at risk. No public exploit code has been identified and the issue does not appear in CISA KEV, though Oracle's own advisory language describes it as 'easily exploitable', so exposure should be treated as urgent for internet- or WAN-reachable deployment instances.
Unauthenticated remote denial of service in Oracle Siebel CRM Deployment (Server Infrastructure component) affects all supported releases from 17.0 through 26.7 and lets any attacker who can reach the deployment service over TCP hang or repeatedly crash it, with CVSS 3.1 scored 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only). Because the flaw needs no credentials, no user interaction, and no special conditions, any internet- or WAN-exposed deployment endpoint is at risk of sustained outage, though impact is limited to availability. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; Oracle's CPU-style advisory at https://www.oracle.com/security-alerts/cspusep2026.html is the authoritative source.
Unauthenticated denial of service against Oracle Siebel CRM Deployment (Server Infrastructure component) lets network-reachable attackers hang or repeatedly crash the service, taking the deployment offline; affected releases span 17.0 through 26.7. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U, availability-only impact), meaning no credentials, no user interaction, and no special complexity are required — a low bar for automation. No public exploit code or CISA KEV listing was identified in the supplied intelligence at time of analysis, so the immediate concern is exposure management rather than confirmed active exploitation.
Authentication bypass in the Server Infrastructure component of Oracle Siebel CRM Deployment (supported versions 17.0 through 26.7) lets an unauthenticated remote attacker reach the HTTP interface and take full read/write control of deployment data. The assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (score 9.1) confirms no credentials, no user interaction, and no non-default configuration are required; impact is confined to confidentiality and integrity, so data can be stolen or tampered with but the service cannot be disrupted (A:N). No public exploit code has been identified at time of analysis and CISA SSVC rates exploitation as 'none', though the flaw is rated automatable with total technical impact - making exposure reduction the key control while patching.
Authentication bypass in the Server Infrastructure component of Oracle Siebel CRM Deployment (versions 17.0 through 26.7) lets an unauthenticated remote attacker reach critical CRM data over HTTP and read, create, delete, or modify it at will. Rated CVSS 3.1 base 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and classified CWE-287, the flaw requires no credentials and no user interaction - the only meaningful barrier is network reachability of the Siebel HTTP interface. No public exploit code exists and there is no confirmed active exploitation (CISA SSVC exploitation: none), but the issue is assessed as automatable with total technical impact, so exposure should be treated as urgent for internet-facing deployments; EPSS data was not provided for this CVE.
Unauthenticated denial of service in Oracle Siebel CRM Deployment (Server Infrastructure component) affecting release levels 17.0 through 26.7. An attacker who can reach the deployment infrastructure over HTTP can send crafted requests that hang or repeatedly crash the service, producing a complete denial of service with no confidentiality or integrity impact. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied; the risk is driven by the low attack complexity and lack of required credentials rather than by observed exploitation.
Unauthenticated attackers with network reachability to the Siebel CRM Open UI SOAP interface can bypass authentication in Oracle Siebel CRM End User versions 17.0 through 26.7 and obtain full read, create, modify, and delete access to all data reachable through the affected component. Rated CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), the flaw requires no credentials, no user interaction, and has low attack complexity, though it carries no availability impact (A:N). No public exploit code and no confirmed active exploitation were identified at time of analysis, so the primary real-world risk driver is whether the SOAP endpoint of a given deployment is exposed beyond trusted networks.
Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 expose a flaw in the Siebel Cloud Manager component that lets an attacker already holding a low-privileged account on the platform, and positioned on the same physical/adjacent network segment as the hosting hardware, read essentially all CRM data, modify or delete some of it, and partially disrupt service. The CVSS 3.1 base score is 8.2 (AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L), and the scope-change metric indicates the compromise can spill over into additional products beyond Siebel itself. No public exploit code has been identified and the issue is not listed in CISA KEV, but it should not be ignored: the confidentiality impact is total, Oracle rates exploitability as 'easily exploitable', and no EPSS score or CWE mapping was supplied to further refine the risk picture.
Unauthenticated attackers who can reach the HTTP interface of Oracle Siebel CRM Cloud Applications, specifically the Siebel Cloud Manager component, can bypass authentication and gain full read access to critical CRM data plus limited ability to insert, update or delete records. The flaw affects supported releases 22.3 through 26.7 and carries a CVSS 3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N, C:H/I:L/A:N), meaning it is remotely reachable, low complexity and requires no credentials or user interaction. No public exploit code or CISA KEV listing was present in the supplied intelligence, so exploitation status is unconfirmed at time of analysis.
Unauthenticated attackers with HTTP network access can read critical data from Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 by exploiting an authentication bypass in the Siebel Cloud Manager component. The flaw is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) with high confidentiality impact only - integrity and availability are unaffected - meaning a successful hit exposes all data reachable through the affected component. No public exploit code, EPSS score, or CISA KEV entry was supplied in the intelligence feed, so active exploitation is currently unconfirmed.
Unauthenticated attackers with network reachability to the SSH interface of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.7) can bypass authentication and gain unauthorized access to critical CRM data through the Siebel Cloud Manager component. Oracle scores the flaw 8.6 with a scope change, meaning a successful compromise can extend beyond the Siebel deployment to affect additional products. No public exploit code, EPSS score, or CISA KEV entry was provided at the time of analysis, although the low-complexity, no-credentials attack profile makes rapid weaponization plausible.
Local privilege escalation in the Installation component of Oracle Siebel CRM Deployment (supported versions 17.0 through 26.7) lets any low-privileged user who can log on to the host running Siebel CRM Deployment to fully compromise that deployment. Because the flaw is reachable through the local attack surface with no user interaction and yields complete loss of confidentiality, integrity and availability, an attacker with an otherwise ordinary account can effectively take over the CRM environment. No public exploit code or in-the-wild exploitation is identified in the available intelligence at time of analysis, and the vendor advisory from Oracle is the sole reference for affected versions and fixes.
Full system takeover is achievable in Oracle Siebel CRM End User versions 17.0 through 26.6 via the Document Management component over HTTP, exploitable by any low-privileged authenticated user without user interaction. The CVSS 8.8 score reflects complete confidentiality, integrity, and availability impact, consistent with the vendor's characterization of 'takeover' of the End User instance. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range make this a priority patching target for any organization running affected Siebel deployments.
Full system takeover in Oracle Siebel CRM Deployment's Server Infrastructure component is achievable by any low-privileged attacker with network HTTP access, affecting versions 17.0 through 26.6. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms exploitation is straightforward - no elevated privileges, no user interaction, and low complexity - resulting in complete compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low barrier to exploitation makes this a high-priority patching target for organizations running affected Siebel deployments.
Unauthenticated remote data exposure in Oracle Siebel CRM Integration's REST component allows network attackers to read all CRM-accessible data without credentials across versions 17.0 through 26.6. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is exploitable with no authentication and minimal attack complexity, yielding complete confidentiality loss. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Full takeover of Oracle Siebel CRM Integration (versions 17.0-26.6) is achievable by a low-privileged authenticated attacker over HTTP, exploiting a flaw in the REST component. The CVSS scope change (S:C) means successful exploitation can pivot beyond the directly targeted service, potentially compromising additional Oracle or backend systems. No public exploit has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog; however, the C:H/I:H/A:H impact triad warrants prioritized patching for organizations running Siebel in enterprise environments.
Oracle Siebel CRM End User versions 17.0 through 26.6 expose a network-exploitable flaw in the Open UI component that, when triggered via a crafted HTTPS interaction, grants a low-privileged attacker full read and write access to critical CRM data - including complete confidentiality and integrity compromise with a documented scope change to additional products. The 'Authentication Bypass' tag reported by Oracle's security team suggests the Open UI layer can be manipulated to circumvent access controls in the context of an authenticated victim's session. No exploit code is publicly available and the vulnerability is not listed in the CISA KEV catalog at the time of analysis.
Full system takeover of Oracle Siebel CRM Deployment (versions 17.0 through 26.6) is achievable by unauthenticated remote attackers via HTTP, targeting the Migration component. The attack requires human interaction from a victim - a social engineering or luring condition that constrains opportunistic exploitation - but successful exploitation results in complete compromise of confidentiality, integrity, and availability of the Siebel CRM Deployment instance. No public exploit code has been identified at time of analysis, and this vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog.
Unauthorized data access in Oracle Siebel CRM Integration versions 25.12 through 26.6 allows low-privileged network attackers to read all CRM-accessible data and perform limited data manipulation via HTTP against the Open Integration component, with a confirmed scope change extending impact to additional integrated products. The vulnerability is tagged by Oracle as an Authentication Bypass, enabling a valid but low-privileged account to exceed its authorized access boundaries without elevated complexity or user interaction. No public exploit has been identified at time of analysis, but the combination of low attack complexity, network accessibility, and scope change makes this a credible high-priority threat in enterprise Siebel deployments.
Oracle Siebel CRM Integration versions 25.12-26.6 exposes a high-severity authentication bypass in its Open Integration component that permits an unauthenticated attacker on the same physical network segment to fully read and modify all data accessible through the integration layer. The CVSS 8.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) confirms low-complexity, credential-free exploitation, though the adjacent-network requirement materially constrains the attacker population to insiders or laterally-moved threat actors. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Integrity and availability compromise in Oracle Siebel CRM Integration's Open Integration component (versions 25.12 through 26.6) allows a high-privileged remote attacker over HTTP to corrupt or destroy critical data and trigger a complete denial of service, with confirmed scope change meaning successful exploitation may cascade into additional integrated downstream products. The attack requires high complexity and pre-existing administrative privileges, limiting opportunistic exploitation, but the cross-system blast radius elevates overall business risk. No public exploit code has been identified and this vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Unauthorized data disclosure in Oracle Siebel CRM Integration (versions 25.12 through 26.6) allows a low-privileged authenticated attacker to access critical or complete CRM data via HTTP by exploiting an authentication bypass in the Open Integration component. The scope change (S:C) in the CVSS vector means successful exploitation can extend data exposure beyond Siebel CRM Integration to additional integrated Oracle products. No public exploit code or CISA KEV listing exists at time of analysis, but the low attack complexity and no user-interaction requirement make this readily actionable for any attacker holding even minimal valid credentials.
Full compromise of Oracle Siebel CRM Integration (Open Integration component) is possible by an unauthenticated remote attacker over HTTP, per Oracle's August 2026 Critical Patch Update. Affected releases span Siebel CRM Integration 25.12 through 26.6, and successful exploitation yields complete takeover of the Integration component with full confidentiality, integrity, and availability impact (CVSS 9.8). No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the unauthenticated, low-complexity network profile makes it a high-priority patch item.
Remote authentication bypass in Oracle Siebel CRM Integration (Open Integration component, versions 25.12-26.6) allows unauthenticated network attackers via HTTP to achieve full confidentiality and integrity compromise of CRM data when a victim user interacts with attacker-controlled content. The vulnerability enables unauthorized read, create, delete, and modification access to all Siebel CRM Integration accessible data. Tagged as an Authentication Bypass by Oracle and scored CVSS 8.1 (High), no public exploit code or CISA KEV listing has been identified at time of analysis.
Siebel CRM Integration versions 25.12 through 26.6 expose a network-exploitable flaw in the Open Integration component that permits a low-privileged attacker to achieve full system takeover via crafted HTTP requests under high-complexity conditions. The CVSS 3.1 score of 8.5 reflects a scope change (S:C) alongside full confidentiality, integrity, and availability impact, meaning successful exploitation can cascade to other Oracle and third-party systems connected through the integration layer. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed the issue in the August 2026 Critical Security Patch Update.
Authentication bypass in Oracle Siebel CRM Integration (Open Integration component, versions 25.12-26.6) allows a remote unauthenticated attacker reachable over HTTP to gain unauthorized read and write access to critical CRM data, with a confirmed scope change meaning successful exploitation can cascade to impact additional integrated systems beyond Siebel itself. The AC:H rating indicates exploitation is difficult and likely requires meeting specific environmental or timing conditions, tempering the urgency implied by the 8.7 CVSS score. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Full compromise of Oracle Siebel CRM Integration (Open Integration component) is achievable by a low-privileged, network-based attacker over HTTP, with a scope change that lets attacks significantly impact additional products beyond the vulnerable component. Affected releases span 25.12 through 26.6, and Oracle rates it CVSS 3.1 9.9 with full confidentiality, integrity, and availability loss (component takeover). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of low attack complexity, low privilege requirement, and scope change makes it a top-tier patch priority.
Unauthorized data access and partial data manipulation in Oracle Siebel CRM's Data Archival component exposes critical CRM data to low-privileged network attackers via HTTP. Affected versions 25.12 through 26.6 allow an authenticated low-privileged user to gain complete read access to all Siebel CRM Administration accessible data and perform unauthorized write operations on a subset of that data. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though the 'Authentication Bypass' tag suggests the flaw enables privilege escalation beyond the attacker's authorized scope within the application.
Unauthenticated network exploitation of the Data Archival component in Oracle Siebel CRM Administration exposes complete CRM data to unauthorized access over HTTP. Affecting versions 25.12 through 26.6, the vulnerability carries a CVSS 3.1 score of 8.6 with a confirmed scope change, meaning successful exploitation can cascade to impact additional Oracle or integrated enterprise products beyond the Siebel CRM Administration interface itself. No public exploit or CISA KEV listing has been identified at time of analysis, but the zero-authentication, low-complexity attack surface makes this a high-priority patching target for any organization with internet-exposed Siebel administrative interfaces.
Remote takeover of Oracle Siebel CRM Administration is possible via its Data Archival component, where an unauthenticated attacker with only HTTP network access can fully compromise the module. Oracle rates this CVSS 9.8 with high confidentiality, integrity, and availability impact, and it was disclosed in the August 2026 Oracle Critical Patch Update. At time of analysis there is no public exploit identified and no CISA KEV listing, but the trivial exploitability (AV:N/AC:L/PR:N/UI:N) makes it a high-priority patch for Siebel operators.
Privilege escalation to full takeover in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3 through 26.6) lets a low-privileged attacker with only HTTP network access fully compromise the application and, because of a scope change, meaningfully impact additional connected products. Oracle rates it CVSS 3.1 9.9 with high confidentiality, integrity, and availability impact; it was disclosed in the Oracle Critical Patch Update of August 2026. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Compromise of Oracle Siebel CRM Cloud Applications (versions 22.3-26.6) is achievable by a low-privileged, network-authenticated attacker over HTTP targeting the Siebel Cloud Manager component. Successful exploitation yields unauthorized creation, deletion, or modification of critical CRM data (high integrity impact), partial unauthorized read of CRM data (low confidentiality impact), and the ability to cause a complete, repeatable denial-of-service crash of the application. No public exploit code and no CISA KEV listing are confirmed at time of analysis; EPSS data was not supplied in the source intelligence.
Local privilege escalation in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) enables a low-privileged attacker with logon access to the hosting infrastructure to fully compromise the application via the Siebel Cloud Manager component. Successful exploitation results in complete application takeover with high confidentiality, integrity, and availability impacts. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated remote compromise of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) is possible through the Siebel Cloud Manager component via crafted HTTP requests, requiring no privileges or user interaction. An attacker can gain full read access to all Siebel CRM Cloud data, perform limited unauthorized writes, and cause a partial denial of service, and because the flaw carries a scope change, exploitation can significantly impact additional connected products beyond Siebel itself. Rated CVSS 9.9; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated adjacent-network exploitation of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) via the Siebel Cloud Manager component allows complete read and write access to all CRM data without credentials. The CVSS vector (AV:A/AC:L/PR:N/UI:N) confirms low-complexity, zero-authentication exploitation, constrained only by the requirement for physical or logical adjacency to the target network segment. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the authentication bypass tag and high integrity/confidentiality impact make this a serious concern for any environment with exposed CRM infrastructure.
Full application takeover in Oracle Siebel CRM Cloud Applications (versions 22.3-26.6) is achievable by any low-privileged, network-accessible attacker via HTTP against the Siebel Cloud Manager component, with no user interaction required. Oracle classifies this as 'easily exploitable' and the CVSS vector confirms high impact across confidentiality, integrity, and availability - consistent with a complete system compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range across four years of releases materially raises real-world risk for unpatched enterprise deployments.
Local privilege abuse in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) allows a low-privileged OS-level user on the hosting infrastructure to compromise the Siebel Cloud Manager component, achieving full read access to all CRM application data and limited write access, with a confirmed scope change extending impact to additional co-hosted products. The attack vector is local infrastructure access, making this primarily an insider threat or post-compromise lateral movement risk rather than an external internet-facing exposure. No public exploit has been identified, and Oracle addressed this vulnerability in the August 2026 Critical Patch Update (CPU Aug 2026).
High-privileged remote exploitation of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) via the Siebel Cloud Manager component enables full confidentiality and integrity compromise of Siebel data, with a documented scope change allowing cascading impact on additional Oracle products in the environment. Oracle's August 2026 Critical Security Patch Update discloses a CVSS 3.1 base score of 8.7, reflecting network-accessible exploitation requiring no interaction but demanding high-privilege credentials. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Siebel Cloud Manager in Oracle Siebel CRM Cloud Applications exposes a network-accessible, low-complexity attack path that allows any low-privileged authenticated user to fully take over the application via HTTP. Affected versions span 22.3 through 26.6, a multi-year range covering a substantial portion of the deployed base. No public exploit has been identified at time of analysis; however, Oracle's own characterization of this as 'easily exploitable' and the complete C/I/A impact make this a high-priority remediation target from the August 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3-26.6) allows a low-privileged, network-authenticated attacker to read the entirety of accessible CRM data and perform limited unauthorized data writes via standard HTTP requests. The vulnerability carries a confirmed scope change, meaning successful exploitation of the Siebel Cloud Manager component can cascade to compromise data in additional integrated Oracle products beyond the initial target. No public exploit code has been identified at time of analysis, but the low attack complexity combined with only a low-privilege requirement makes this a realistic and urgent patching priority for any organization running a Siebel CRM Cloud deployment.
Unauthorized data access and manipulation in Oracle Siebel CRM Cloud Applications (versions 22.3-26.6) is achievable by low-privileged, network-connected attackers via HTTP against the Siebel Cloud Manager component. Successful exploitation grants complete read access to all CRM data and the ability to create, delete, or modify critical records, with no availability disruption to the service itself. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low attack complexity and low privilege requirement lower the bar for a targeted threat actor with valid credentials.
Full application takeover in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 through 26.6, lets a remote unauthenticated attacker fully compromise the system over HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) with a 9.8 base score and full high impact on confidentiality, integrity, and availability marks this as a pre-authentication, network-reachable critical flaw disclosed in Oracle's August 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivially-exploitable, unauthenticated profile makes it a high-priority patch target.
Privilege-based takeover of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) is possible via the Siebel Cloud Manager component, where a low-privileged attacker with HTTP network access can fully compromise the application. Because the flaw carries a scope change, successful attacks can significantly impact additional connected products beyond Siebel itself. Rated CVSS 3.1 9.9 with full confidentiality, integrity, and availability impact; no public exploit identified at time of analysis.
Unauthenticated remote exploitation of Oracle Siebel CRM Integration's REST component across versions 17.0 through 26.6 can yield complete loss of data confidentiality and integrity. Tagged as an authentication bypass, the vulnerability permits network-accessible attackers to read all CRM data and perform unauthorized create, delete, or modify operations without credentials. No public exploit has been identified at time of analysis, and Oracle's August 2026 Critical Patch Update addresses the issue.
Unauthorized access to critical CRM data and partial data manipulation in Oracle Siebel CRM Deployment (versions 17.0-26.6) is achievable via the Migration component by any low-privileged attacker with HTTP network access, with a documented scope change indicating that successful exploitation can cascade to affect additional Oracle products beyond the directly targeted component. The CVSS 3.1 base score of 8.5 reflects low attack complexity and no user interaction requirement, making exploitation straightforward for any holder of a valid low-privilege credential. No public exploit has been identified at time of analysis and no CISA KEV listing exists, though the breadth of affected versions spanning nearly a decade of releases represents substantial organizational exposure.
Oracle Siebel CRM Integration's REST component (versions 17.0 through 26.6) contains an authentication bypass flaw enabling unauthenticated network attackers to fully compromise data confidentiality and integrity over HTTPS. The 'Authentication Bypass' tag from the Oracle reporter confirms the vulnerability class: an attacker who satisfies the high-complexity exploitation condition can read all CRM data and perform unauthorized creation, modification, or deletion of records. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog at time of analysis.
Unauthenticated remote access to Oracle Siebel CRM Integration's REST component (versions 17.0 through 26.6) exposes all CRM integration data to unauthorized disclosure and enables partial denial of service via plain HTTP. The vulnerability requires no credentials, no user interaction, and no special configuration beyond the REST interface being reachable, making it exploitable by any network-adjacent or internet-facing attacker. No public exploit has been identified at time of analysis, but Oracle's Critical Patch Update for August 2026 confirms the issue and its severity classification of CVSS 8.2.
Oracle Siebel CRM Deployment's Server Infrastructure component exposes versions 17.0 through 26.6 to an unauthenticated, network-based authentication bypass over HTTP that can result in complete compromise of CRM data confidentiality and integrity. The high complexity rating (AC:H) tempers immediate mass-exploitation risk, but the Authentication Bypass tag combined with C:H and I:H impact means a successful attacker achieves full read and write access to all CRM-accessible data - including customer records, sales pipelines, and service data - without presenting valid credentials. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle's Critical Security Patch Update for August 2026 addresses this vulnerability.
Oracle Siebel CRM Deployment's Application Interface component (versions 17.0 through 26.6) exposes complete read and write access to all CRM data to unauthenticated attackers positioned on the adjacent network segment. The CVSS vector confirms zero authentication requirements and low attack complexity, meaning any actor with access to the physical communication segment hosting the Siebel server can silently exfiltrate or corrupt the entire CRM dataset. No active exploitation has been confirmed in the CISA KEV catalog and no public exploit code has been identified at time of analysis, but the authentication bypass classification combined with high confidentiality and integrity impact makes this a credible priority for organizations with insufficiently segmented internal networks.
Remote authentication bypass in Oracle Siebel CRM Integration's REST component affects all supported versions from 17.0 through 26.6, enabling unauthenticated network attackers to achieve full read and write access to critical CRM data via crafted HTTPS requests. The vulnerability is tagged Authentication Bypass, indicating that REST API access controls can be circumvented without credentials despite a high attack complexity (AC:H) rating that suggests exploitation requires precise crafting or internal state knowledge. No public exploit identified at time of analysis, but the combination of unauthenticated access and high confidentiality and integrity impact warrants priority patching under Oracle's August 2026 Critical Patch Update.
Unauthenticated adjacent-network exploitation of Oracle Siebel CRM's Search component allows complete read and write access to all CRM data across versions 17.0 through 26.6. Successful exploitation enables creation, deletion, and modification of critical data as well as full confidentiality compromise without any prior authentication or user interaction. No public exploit identified at time of analysis, and this vulnerability is not currently listed in CISA KEV, though its low-complexity, unauthenticated nature makes it a credible priority for organizations with exposed Siebel deployments.
Unauthorized data access in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 through 26.5, lets an unauthenticated remote attacker over HTTP read all Siebel-accessible data, tamper with some records, and cause a partial denial of service. Oracle rates it CVSS 7.0 but flags it as difficult to exploit (AC:H), and no public exploit identified at time of analysis. Disclosed via the Oracle July 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 through 26.5, lets a remote unauthenticated attacker reach sensitive data over HTTP. The flaw is tagged as an authentication bypass and, per Oracle's own scoring, is 'easily exploitable' with a high confidentiality impact but no integrity or availability effect (CVSS 3.1 base 7.5). No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided in the source data.
Unauthorized data access in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3 through 26.5) allows a low-privileged attacker with network HTTP access to read all data accessible to the application. Oracle rates it CVSS 3.1 7.7 with a scope change, and the ENISA EUVD flags an authentication-bypass characteristic, meaning a minimally-authenticated actor can escalate to broad confidentiality compromise that spills into additional connected products. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data access in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3 through 26.5) lets a remote, unauthenticated attacker reach and read critical application data over HTTP. Oracle rates this CVSS 3.1 7.5 with confidentiality-only impact, and the intelligence tags flag it as an authentication-bypass class issue, so attackers can obtain complete access to all data accessible to the affected applications without credentials. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.9 can be taken over by an attacker who already holds a high-privileged account and has interactive logon access to the infrastructure host where the component executes. The issue is rated CVSS 3.1 base 6.7 with high confidentiality, integrity, and availability impact, but the local attack vector (AV:L) and high-privilege prerequisite (PR:H) sharply constrain the realistic attacker population to insiders or actors who already have a foothold. No public exploit identified at time of analysis; no CISA KEV entry is present in the provided data.
Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 through 26.7, permits low-privileged authenticated users with HTTP network access to reach functionality they should not control, enabling unauthorized read and modification of data and affecting systems beyond the vulnerable component (scope change). The flaw is rated CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting an easily automated but credential-gated attack with limited confidentiality and integrity impact. No public exploit code or CISA KEV entry is identified at time of analysis, and no CWE classification was assigned by the reporting source.
Oracle Siebel CRM Deployment (Cloud Gateway component) versions 17.0 through 26.7 contains a hard-to-exploit flaw that lets a low-privileged attacker with HTTP network access read and modify critical CRM data, with Oracle rating both confidentiality and integrity impact as High. The vendor advisory does not disclose the root cause, and no public exploit code, EPSS score, or CISA KEV entry was supplied with this record, so real-world exploitation is unconfirmed. The associated 'Authentication Bypass' tag is not corroborated by the Oracle text, which describes unauthorized data creation, deletion, and modification rather than an explicit credential-check bypass.
Unauthorized data access and manipulation is possible in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.5) via a flaw in the Siebel Cloud Manager component, tagged as an Authentication Bypass. An unauthenticated attacker positioned on the same physical network segment as the hosting hardware can, under high-complexity conditions, read a subset of accessible CRM data and perform unauthorized inserts or modifications. No confirmed active exploitation (CISA KEV) and no public proof-of-concept have been identified at time of analysis, and the CVSS 4.2 score accurately reflects the constrained adjacency and complexity requirements.
Unauthorized data manipulation via authentication bypass in Oracle Siebel CRM Integration's Siebel Server Sync for Exchange component allows unauthenticated remote attackers to insert, update, or delete a subset of CRM-accessible data over HTTP. All versions from 17.0 through 26.5 are affected, with exploitation constrained by high attack complexity that substantially reduces real-world risk. No public exploit code or active exploitation has been identified at time of analysis, consistent with the low CVSS score of 3.7 reflecting limited, integrity-only impact.
Unauthenticated information disclosure in Oracle Siebel CRM's End User User Interface component allows remote attackers to read a subset of CRM data over HTTP without credentials. Versions 25.0 through 25.5 are confirmed affected. Oracle has released a fix in the July 2025 Critical Patch Update; no public exploit or active exploitation has been identified at time of analysis.
Vulnerability in the Siebel CRM product of Oracle Siebel CRM (component: UI Framework). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the Siebel CRM product of Oracle Siebel CRM (component: Siebel Core - Server Infrastructure). Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Vulnerability in the Siebel Core - DB Deployment and Configuration product of Oracle Siebel CRM (component: Install - Configuration). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Siebel Core - Server BizLogic Script component of Oracle Siebel CRM (subcomponent: Integration - Scripting). Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, low attack complexity.
Unspecified vulnerability in the Siebel Core - Server Framework component in Oracle Siebel CRM IP2014 and IP2015 allows remote attackers to affect confidentiality via unknown vectors related to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1, 8.22, and 15.0 allows remote authenticated users to affect confidentiality via vectors related to UIF Open. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable.
Unspecified vulnerability in the Siebel Core - Server OM Svcs component in Oracle Siebel CRM 8.1.1, 8.2.2, and 15.0 allows remote attackers to affect confidentiality via vectors related to LDAP. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Unspecified vulnerability in the Siebel Core - Server OM Svcs component in Oracle Siebel CRM 8.1.1, 8.2.2, and 15.0 allows remote authenticated users to affect confidentiality via unknown vectors. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1, 8.2.2, and 15.0 allows remote attackers to affect integrity via vectors related to SWSE Server. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1 and 8.2 allows remote attackers to affect integrity via unknown vectors related to Portal Framework. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Oracle Enterprise Asset Management component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Portal Framework,. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Portal. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity.
Unspecified vulnerability in the Siebel Core - Server BizLogic Script component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect integrity via vectors related to Integration -. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Unspecified vulnerability in the Siebel Life Sciences component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unspecified vulnerability in the Siebel Core - Server BizLogic Script component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality, integrity, and. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Portal. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unspecified vulnerability in the Siebel Core - Server OM Services component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via vectors related to. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unspecified vulnerability in the Siebel Public Sector component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect integrity via unknown vectors related to Public Sector. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect integrity via unknown vectors related to AX/HI Web UI. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel Core - EAI component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Java Integration, a. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity.
Unspecified vulnerability in the Siebel Core - Server Infrastructure component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel Core - EAI component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect availability via unknown vectors related to Integration. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel Core EAI component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect availability via unknown vectors related to Integration. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unspecified vulnerability in the Siebel Core - Common Components component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect integrity via unknown vectors related to Portal Framework. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel Core - System Management component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity.