Siebel Crm
Monthly
Full system takeover is achievable in Oracle Siebel CRM End User versions 17.0 through 26.6 via the Document Management component over HTTP, exploitable by any low-privileged authenticated user without user interaction. The CVSS 8.8 score reflects complete confidentiality, integrity, and availability impact, consistent with the vendor's characterization of 'takeover' of the End User instance. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range make this a priority patching target for any organization running affected Siebel deployments.
Full system takeover in Oracle Siebel CRM Deployment's Server Infrastructure component is achievable by any low-privileged attacker with network HTTP access, affecting versions 17.0 through 26.6. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms exploitation is straightforward - no elevated privileges, no user interaction, and low complexity - resulting in complete compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low barrier to exploitation makes this a high-priority patching target for organizations running affected Siebel deployments.
Unauthenticated remote data exposure in Oracle Siebel CRM Integration's REST component allows network attackers to read all CRM-accessible data without credentials across versions 17.0 through 26.6. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is exploitable with no authentication and minimal attack complexity, yielding complete confidentiality loss. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Full takeover of Oracle Siebel CRM Integration (versions 17.0-26.6) is achievable by a low-privileged authenticated attacker over HTTP, exploiting a flaw in the REST component. The CVSS scope change (S:C) means successful exploitation can pivot beyond the directly targeted service, potentially compromising additional Oracle or backend systems. No public exploit has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog; however, the C:H/I:H/A:H impact triad warrants prioritized patching for organizations running Siebel in enterprise environments.
Oracle Siebel CRM End User versions 17.0 through 26.6 expose a network-exploitable flaw in the Open UI component that, when triggered via a crafted HTTPS interaction, grants a low-privileged attacker full read and write access to critical CRM data - including complete confidentiality and integrity compromise with a documented scope change to additional products. The 'Authentication Bypass' tag reported by Oracle's security team suggests the Open UI layer can be manipulated to circumvent access controls in the context of an authenticated victim's session. No exploit code is publicly available and the vulnerability is not listed in the CISA KEV catalog at the time of analysis.
Full system takeover of Oracle Siebel CRM Deployment (versions 17.0 through 26.6) is achievable by unauthenticated remote attackers via HTTP, targeting the Migration component. The attack requires human interaction from a victim - a social engineering or luring condition that constrains opportunistic exploitation - but successful exploitation results in complete compromise of confidentiality, integrity, and availability of the Siebel CRM Deployment instance. No public exploit code has been identified at time of analysis, and this vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog.
Unauthorized data access in Oracle Siebel CRM Integration versions 25.12 through 26.6 allows low-privileged network attackers to read all CRM-accessible data and perform limited data manipulation via HTTP against the Open Integration component, with a confirmed scope change extending impact to additional integrated products. The vulnerability is tagged by Oracle as an Authentication Bypass, enabling a valid but low-privileged account to exceed its authorized access boundaries without elevated complexity or user interaction. No public exploit has been identified at time of analysis, but the combination of low attack complexity, network accessibility, and scope change makes this a credible high-priority threat in enterprise Siebel deployments.
Oracle Siebel CRM Integration versions 25.12-26.6 exposes a high-severity authentication bypass in its Open Integration component that permits an unauthenticated attacker on the same physical network segment to fully read and modify all data accessible through the integration layer. The CVSS 8.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) confirms low-complexity, credential-free exploitation, though the adjacent-network requirement materially constrains the attacker population to insiders or laterally-moved threat actors. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Integrity and availability compromise in Oracle Siebel CRM Integration's Open Integration component (versions 25.12 through 26.6) allows a high-privileged remote attacker over HTTP to corrupt or destroy critical data and trigger a complete denial of service, with confirmed scope change meaning successful exploitation may cascade into additional integrated downstream products. The attack requires high complexity and pre-existing administrative privileges, limiting opportunistic exploitation, but the cross-system blast radius elevates overall business risk. No public exploit code has been identified and this vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Unauthorized data disclosure in Oracle Siebel CRM Integration (versions 25.12 through 26.6) allows a low-privileged authenticated attacker to access critical or complete CRM data via HTTP by exploiting an authentication bypass in the Open Integration component. The scope change (S:C) in the CVSS vector means successful exploitation can extend data exposure beyond Siebel CRM Integration to additional integrated Oracle products. No public exploit code or CISA KEV listing exists at time of analysis, but the low attack complexity and no user-interaction requirement make this readily actionable for any attacker holding even minimal valid credentials.
Full compromise of Oracle Siebel CRM Integration (Open Integration component) is possible by an unauthenticated remote attacker over HTTP, per Oracle's August 2026 Critical Patch Update. Affected releases span Siebel CRM Integration 25.12 through 26.6, and successful exploitation yields complete takeover of the Integration component with full confidentiality, integrity, and availability impact (CVSS 9.8). No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the unauthenticated, low-complexity network profile makes it a high-priority patch item.
Remote authentication bypass in Oracle Siebel CRM Integration (Open Integration component, versions 25.12-26.6) allows unauthenticated network attackers via HTTP to achieve full confidentiality and integrity compromise of CRM data when a victim user interacts with attacker-controlled content. The vulnerability enables unauthorized read, create, delete, and modification access to all Siebel CRM Integration accessible data. Tagged as an Authentication Bypass by Oracle and scored CVSS 8.1 (High), no public exploit code or CISA KEV listing has been identified at time of analysis.
Siebel CRM Integration versions 25.12 through 26.6 expose a network-exploitable flaw in the Open Integration component that permits a low-privileged attacker to achieve full system takeover via crafted HTTP requests under high-complexity conditions. The CVSS 3.1 score of 8.5 reflects a scope change (S:C) alongside full confidentiality, integrity, and availability impact, meaning successful exploitation can cascade to other Oracle and third-party systems connected through the integration layer. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed the issue in the August 2026 Critical Security Patch Update.
Authentication bypass in Oracle Siebel CRM Integration (Open Integration component, versions 25.12-26.6) allows a remote unauthenticated attacker reachable over HTTP to gain unauthorized read and write access to critical CRM data, with a confirmed scope change meaning successful exploitation can cascade to impact additional integrated systems beyond Siebel itself. The AC:H rating indicates exploitation is difficult and likely requires meeting specific environmental or timing conditions, tempering the urgency implied by the 8.7 CVSS score. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Full compromise of Oracle Siebel CRM Integration (Open Integration component) is achievable by a low-privileged, network-based attacker over HTTP, with a scope change that lets attacks significantly impact additional products beyond the vulnerable component. Affected releases span 25.12 through 26.6, and Oracle rates it CVSS 3.1 9.9 with full confidentiality, integrity, and availability loss (component takeover). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of low attack complexity, low privilege requirement, and scope change makes it a top-tier patch priority.
Unauthorized data access and partial data manipulation in Oracle Siebel CRM's Data Archival component exposes critical CRM data to low-privileged network attackers via HTTP. Affected versions 25.12 through 26.6 allow an authenticated low-privileged user to gain complete read access to all Siebel CRM Administration accessible data and perform unauthorized write operations on a subset of that data. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though the 'Authentication Bypass' tag suggests the flaw enables privilege escalation beyond the attacker's authorized scope within the application.
Unauthenticated network exploitation of the Data Archival component in Oracle Siebel CRM Administration exposes complete CRM data to unauthorized access over HTTP. Affecting versions 25.12 through 26.6, the vulnerability carries a CVSS 3.1 score of 8.6 with a confirmed scope change, meaning successful exploitation can cascade to impact additional Oracle or integrated enterprise products beyond the Siebel CRM Administration interface itself. No public exploit or CISA KEV listing has been identified at time of analysis, but the zero-authentication, low-complexity attack surface makes this a high-priority patching target for any organization with internet-exposed Siebel administrative interfaces.
Remote takeover of Oracle Siebel CRM Administration is possible via its Data Archival component, where an unauthenticated attacker with only HTTP network access can fully compromise the module. Oracle rates this CVSS 9.8 with high confidentiality, integrity, and availability impact, and it was disclosed in the August 2026 Oracle Critical Patch Update. At time of analysis there is no public exploit identified and no CISA KEV listing, but the trivial exploitability (AV:N/AC:L/PR:N/UI:N) makes it a high-priority patch for Siebel operators.
Privilege escalation to full takeover in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3 through 26.6) lets a low-privileged attacker with only HTTP network access fully compromise the application and, because of a scope change, meaningfully impact additional connected products. Oracle rates it CVSS 3.1 9.9 with high confidentiality, integrity, and availability impact; it was disclosed in the Oracle Critical Patch Update of August 2026. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Compromise of Oracle Siebel CRM Cloud Applications (versions 22.3-26.6) is achievable by a low-privileged, network-authenticated attacker over HTTP targeting the Siebel Cloud Manager component. Successful exploitation yields unauthorized creation, deletion, or modification of critical CRM data (high integrity impact), partial unauthorized read of CRM data (low confidentiality impact), and the ability to cause a complete, repeatable denial-of-service crash of the application. No public exploit code and no CISA KEV listing are confirmed at time of analysis; EPSS data was not supplied in the source intelligence.
Local privilege escalation in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) enables a low-privileged attacker with logon access to the hosting infrastructure to fully compromise the application via the Siebel Cloud Manager component. Successful exploitation results in complete application takeover with high confidentiality, integrity, and availability impacts. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated remote compromise of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) is possible through the Siebel Cloud Manager component via crafted HTTP requests, requiring no privileges or user interaction. An attacker can gain full read access to all Siebel CRM Cloud data, perform limited unauthorized writes, and cause a partial denial of service, and because the flaw carries a scope change, exploitation can significantly impact additional connected products beyond Siebel itself. Rated CVSS 9.9; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated adjacent-network exploitation of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) via the Siebel Cloud Manager component allows complete read and write access to all CRM data without credentials. The CVSS vector (AV:A/AC:L/PR:N/UI:N) confirms low-complexity, zero-authentication exploitation, constrained only by the requirement for physical or logical adjacency to the target network segment. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the authentication bypass tag and high integrity/confidentiality impact make this a serious concern for any environment with exposed CRM infrastructure.
Full application takeover in Oracle Siebel CRM Cloud Applications (versions 22.3-26.6) is achievable by any low-privileged, network-accessible attacker via HTTP against the Siebel Cloud Manager component, with no user interaction required. Oracle classifies this as 'easily exploitable' and the CVSS vector confirms high impact across confidentiality, integrity, and availability - consistent with a complete system compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range across four years of releases materially raises real-world risk for unpatched enterprise deployments.
Local privilege abuse in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) allows a low-privileged OS-level user on the hosting infrastructure to compromise the Siebel Cloud Manager component, achieving full read access to all CRM application data and limited write access, with a confirmed scope change extending impact to additional co-hosted products. The attack vector is local infrastructure access, making this primarily an insider threat or post-compromise lateral movement risk rather than an external internet-facing exposure. No public exploit has been identified, and Oracle addressed this vulnerability in the August 2026 Critical Patch Update (CPU Aug 2026).
High-privileged remote exploitation of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) via the Siebel Cloud Manager component enables full confidentiality and integrity compromise of Siebel data, with a documented scope change allowing cascading impact on additional Oracle products in the environment. Oracle's August 2026 Critical Security Patch Update discloses a CVSS 3.1 base score of 8.7, reflecting network-accessible exploitation requiring no interaction but demanding high-privilege credentials. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Siebel Cloud Manager in Oracle Siebel CRM Cloud Applications exposes a network-accessible, low-complexity attack path that allows any low-privileged authenticated user to fully take over the application via HTTP. Affected versions span 22.3 through 26.6, a multi-year range covering a substantial portion of the deployed base. No public exploit has been identified at time of analysis; however, Oracle's own characterization of this as 'easily exploitable' and the complete C/I/A impact make this a high-priority remediation target from the August 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3-26.6) allows a low-privileged, network-authenticated attacker to read the entirety of accessible CRM data and perform limited unauthorized data writes via standard HTTP requests. The vulnerability carries a confirmed scope change, meaning successful exploitation of the Siebel Cloud Manager component can cascade to compromise data in additional integrated Oracle products beyond the initial target. No public exploit code has been identified at time of analysis, but the low attack complexity combined with only a low-privilege requirement makes this a realistic and urgent patching priority for any organization running a Siebel CRM Cloud deployment.
Unauthorized data access and manipulation in Oracle Siebel CRM Cloud Applications (versions 22.3-26.6) is achievable by low-privileged, network-connected attackers via HTTP against the Siebel Cloud Manager component. Successful exploitation grants complete read access to all CRM data and the ability to create, delete, or modify critical records, with no availability disruption to the service itself. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low attack complexity and low privilege requirement lower the bar for a targeted threat actor with valid credentials.
Full application takeover in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 through 26.6, lets a remote unauthenticated attacker fully compromise the system over HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) with a 9.8 base score and full high impact on confidentiality, integrity, and availability marks this as a pre-authentication, network-reachable critical flaw disclosed in Oracle's August 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivially-exploitable, unauthenticated profile makes it a high-priority patch target.
Privilege-based takeover of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) is possible via the Siebel Cloud Manager component, where a low-privileged attacker with HTTP network access can fully compromise the application. Because the flaw carries a scope change, successful attacks can significantly impact additional connected products beyond Siebel itself. Rated CVSS 3.1 9.9 with full confidentiality, integrity, and availability impact; no public exploit identified at time of analysis.
Unauthenticated remote exploitation of Oracle Siebel CRM Integration's REST component across versions 17.0 through 26.6 can yield complete loss of data confidentiality and integrity. Tagged as an authentication bypass, the vulnerability permits network-accessible attackers to read all CRM data and perform unauthorized create, delete, or modify operations without credentials. No public exploit has been identified at time of analysis, and Oracle's August 2026 Critical Patch Update addresses the issue.
Unauthorized access to critical CRM data and partial data manipulation in Oracle Siebel CRM Deployment (versions 17.0-26.6) is achievable via the Migration component by any low-privileged attacker with HTTP network access, with a documented scope change indicating that successful exploitation can cascade to affect additional Oracle products beyond the directly targeted component. The CVSS 3.1 base score of 8.5 reflects low attack complexity and no user interaction requirement, making exploitation straightforward for any holder of a valid low-privilege credential. No public exploit has been identified at time of analysis and no CISA KEV listing exists, though the breadth of affected versions spanning nearly a decade of releases represents substantial organizational exposure.
Oracle Siebel CRM Integration's REST component (versions 17.0 through 26.6) contains an authentication bypass flaw enabling unauthenticated network attackers to fully compromise data confidentiality and integrity over HTTPS. The 'Authentication Bypass' tag from the Oracle reporter confirms the vulnerability class: an attacker who satisfies the high-complexity exploitation condition can read all CRM data and perform unauthorized creation, modification, or deletion of records. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog at time of analysis.
Unauthenticated remote access to Oracle Siebel CRM Integration's REST component (versions 17.0 through 26.6) exposes all CRM integration data to unauthorized disclosure and enables partial denial of service via plain HTTP. The vulnerability requires no credentials, no user interaction, and no special configuration beyond the REST interface being reachable, making it exploitable by any network-adjacent or internet-facing attacker. No public exploit has been identified at time of analysis, but Oracle's Critical Patch Update for August 2026 confirms the issue and its severity classification of CVSS 8.2.
Oracle Siebel CRM Deployment's Server Infrastructure component exposes versions 17.0 through 26.6 to an unauthenticated, network-based authentication bypass over HTTP that can result in complete compromise of CRM data confidentiality and integrity. The high complexity rating (AC:H) tempers immediate mass-exploitation risk, but the Authentication Bypass tag combined with C:H and I:H impact means a successful attacker achieves full read and write access to all CRM-accessible data - including customer records, sales pipelines, and service data - without presenting valid credentials. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle's Critical Security Patch Update for August 2026 addresses this vulnerability.
Oracle Siebel CRM Deployment's Application Interface component (versions 17.0 through 26.6) exposes complete read and write access to all CRM data to unauthenticated attackers positioned on the adjacent network segment. The CVSS vector confirms zero authentication requirements and low attack complexity, meaning any actor with access to the physical communication segment hosting the Siebel server can silently exfiltrate or corrupt the entire CRM dataset. No active exploitation has been confirmed in the CISA KEV catalog and no public exploit code has been identified at time of analysis, but the authentication bypass classification combined with high confidentiality and integrity impact makes this a credible priority for organizations with insufficiently segmented internal networks.
Remote authentication bypass in Oracle Siebel CRM Integration's REST component affects all supported versions from 17.0 through 26.6, enabling unauthenticated network attackers to achieve full read and write access to critical CRM data via crafted HTTPS requests. The vulnerability is tagged Authentication Bypass, indicating that REST API access controls can be circumvented without credentials despite a high attack complexity (AC:H) rating that suggests exploitation requires precise crafting or internal state knowledge. No public exploit identified at time of analysis, but the combination of unauthenticated access and high confidentiality and integrity impact warrants priority patching under Oracle's August 2026 Critical Patch Update.
Unauthenticated adjacent-network exploitation of Oracle Siebel CRM's Search component allows complete read and write access to all CRM data across versions 17.0 through 26.6. Successful exploitation enables creation, deletion, and modification of critical data as well as full confidentiality compromise without any prior authentication or user interaction. No public exploit identified at time of analysis, and this vulnerability is not currently listed in CISA KEV, though its low-complexity, unauthenticated nature makes it a credible priority for organizations with exposed Siebel deployments.
Unauthorized data access in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 through 26.5, lets an unauthenticated remote attacker over HTTP read all Siebel-accessible data, tamper with some records, and cause a partial denial of service. Oracle rates it CVSS 7.0 but flags it as difficult to exploit (AC:H), and no public exploit identified at time of analysis. Disclosed via the Oracle July 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 through 26.5, lets a remote unauthenticated attacker reach sensitive data over HTTP. The flaw is tagged as an authentication bypass and, per Oracle's own scoring, is 'easily exploitable' with a high confidentiality impact but no integrity or availability effect (CVSS 3.1 base 7.5). No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided in the source data.
Unauthorized data access in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3 through 26.5) allows a low-privileged attacker with network HTTP access to read all data accessible to the application. Oracle rates it CVSS 3.1 7.7 with a scope change, and the ENISA EUVD flags an authentication-bypass characteristic, meaning a minimally-authenticated actor can escalate to broad confidentiality compromise that spills into additional connected products. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data access in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3 through 26.5) lets a remote, unauthenticated attacker reach and read critical application data over HTTP. Oracle rates this CVSS 3.1 7.5 with confidentiality-only impact, and the intelligence tags flag it as an authentication-bypass class issue, so attackers can obtain complete access to all data accessible to the affected applications without credentials. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Unauthorized data access and manipulation is possible in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.5) via a flaw in the Siebel Cloud Manager component, tagged as an Authentication Bypass. An unauthenticated attacker positioned on the same physical network segment as the hosting hardware can, under high-complexity conditions, read a subset of accessible CRM data and perform unauthorized inserts or modifications. No confirmed active exploitation (CISA KEV) and no public proof-of-concept have been identified at time of analysis, and the CVSS 4.2 score accurately reflects the constrained adjacency and complexity requirements.
Unauthorized data manipulation via authentication bypass in Oracle Siebel CRM Integration's Siebel Server Sync for Exchange component allows unauthenticated remote attackers to insert, update, or delete a subset of CRM-accessible data over HTTP. All versions from 17.0 through 26.5 are affected, with exploitation constrained by high attack complexity that substantially reduces real-world risk. No public exploit code or active exploitation has been identified at time of analysis, consistent with the low CVSS score of 3.7 reflecting limited, integrity-only impact.
Unauthenticated information disclosure in Oracle Siebel CRM's End User User Interface component allows remote attackers to read a subset of CRM data over HTTP without credentials. Versions 25.0 through 25.5 are confirmed affected. Oracle has released a fix in the July 2025 Critical Patch Update; no public exploit or active exploitation has been identified at time of analysis.
Vulnerability in the Siebel CRM product of Oracle Siebel CRM (component: UI Framework). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the Siebel CRM product of Oracle Siebel CRM (component: Siebel Core - Server Infrastructure). Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Vulnerability in the Siebel Core - DB Deployment and Configuration product of Oracle Siebel CRM (component: Install - Configuration). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Siebel Core - Server BizLogic Script component of Oracle Siebel CRM (subcomponent: Integration - Scripting). Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, low attack complexity.
Unspecified vulnerability in the Siebel Core - Server Framework component in Oracle Siebel CRM IP2014 and IP2015 allows remote attackers to affect confidentiality via unknown vectors related to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1, 8.22, and 15.0 allows remote authenticated users to affect confidentiality via vectors related to UIF Open. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable.
Unspecified vulnerability in the Siebel Core - Server OM Svcs component in Oracle Siebel CRM 8.1.1, 8.2.2, and 15.0 allows remote attackers to affect confidentiality via vectors related to LDAP. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Unspecified vulnerability in the Siebel Core - Server OM Svcs component in Oracle Siebel CRM 8.1.1, 8.2.2, and 15.0 allows remote authenticated users to affect confidentiality via unknown vectors. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1, 8.2.2, and 15.0 allows remote attackers to affect integrity via vectors related to SWSE Server. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1 and 8.2 allows remote attackers to affect integrity via unknown vectors related to Portal Framework. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Oracle Enterprise Asset Management component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Portal Framework,. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Portal. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity.
Unspecified vulnerability in the Siebel Core - Server BizLogic Script component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect integrity via vectors related to Integration -. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Unspecified vulnerability in the Siebel Life Sciences component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unspecified vulnerability in the Siebel Core - Server BizLogic Script component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality, integrity, and. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Portal. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unspecified vulnerability in the Siebel Core - Server OM Services component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via vectors related to. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unspecified vulnerability in the Siebel Public Sector component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect integrity via unknown vectors related to Public Sector. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect integrity via unknown vectors related to AX/HI Web UI. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel Core - EAI component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Java Integration, a. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity.
Unspecified vulnerability in the Siebel Core - Server Infrastructure component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel Core - EAI component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect availability via unknown vectors related to Integration. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel Core EAI component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect availability via unknown vectors related to Integration. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unspecified vulnerability in the Siebel Core - Common Components component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect integrity via unknown vectors related to Portal Framework. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel Core - System Management component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity.
Unspecified vulnerability in the Siebel Core - Server OM Frwks component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel Travel & Transportation component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect integrity via unknown vectors related to Diary. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect integrity via vectors related to Open_UI, a different. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect integrity via unknown vectors related to Portal Framework, a. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect integrity via unknown vectors related to Portal Framework, a. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel Core - EAI component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows local users to affect confidentiality via unknown vectors related to Integration Business. Rated low severity (CVSS 1.4), this vulnerability is low attack complexity. No vendor patch available.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect integrity via vectors related to Open_UI, a different. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel Life Sciences component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect availability via unknown vectors related to Clinical. Rated low severity (CVSS 2.8), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel Core - EAI component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Java Integration, a. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unspecified vulnerability in the Siebel Core - Server Infrastructure component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect availability via vectors related to SISNAPI &. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality, integrity, and availability via vectors related. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel Core - EAI component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect availability via unknown vectors related to Web Services. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel Core - EAI component in Oracle Siebel CRM 8.1.1 allows remote authenticated users to affect availability via unknown vectors related to Web Services. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect integrity via unknown vectors related to ActiveX. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unspecified vulnerability in the Siebel Core - Server BizLogic Script component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality and integrity via unknown. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel Core - EAI component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Web Services. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity.
Unspecified vulnerability in the Siebel Core - EAI component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Web. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity.
Full system takeover is achievable in Oracle Siebel CRM End User versions 17.0 through 26.6 via the Document Management component over HTTP, exploitable by any low-privileged authenticated user without user interaction. The CVSS 8.8 score reflects complete confidentiality, integrity, and availability impact, consistent with the vendor's characterization of 'takeover' of the End User instance. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range make this a priority patching target for any organization running affected Siebel deployments.
Full system takeover in Oracle Siebel CRM Deployment's Server Infrastructure component is achievable by any low-privileged attacker with network HTTP access, affecting versions 17.0 through 26.6. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms exploitation is straightforward - no elevated privileges, no user interaction, and low complexity - resulting in complete compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low barrier to exploitation makes this a high-priority patching target for organizations running affected Siebel deployments.
Unauthenticated remote data exposure in Oracle Siebel CRM Integration's REST component allows network attackers to read all CRM-accessible data without credentials across versions 17.0 through 26.6. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is exploitable with no authentication and minimal attack complexity, yielding complete confidentiality loss. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Full takeover of Oracle Siebel CRM Integration (versions 17.0-26.6) is achievable by a low-privileged authenticated attacker over HTTP, exploiting a flaw in the REST component. The CVSS scope change (S:C) means successful exploitation can pivot beyond the directly targeted service, potentially compromising additional Oracle or backend systems. No public exploit has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog; however, the C:H/I:H/A:H impact triad warrants prioritized patching for organizations running Siebel in enterprise environments.
Oracle Siebel CRM End User versions 17.0 through 26.6 expose a network-exploitable flaw in the Open UI component that, when triggered via a crafted HTTPS interaction, grants a low-privileged attacker full read and write access to critical CRM data - including complete confidentiality and integrity compromise with a documented scope change to additional products. The 'Authentication Bypass' tag reported by Oracle's security team suggests the Open UI layer can be manipulated to circumvent access controls in the context of an authenticated victim's session. No exploit code is publicly available and the vulnerability is not listed in the CISA KEV catalog at the time of analysis.
Full system takeover of Oracle Siebel CRM Deployment (versions 17.0 through 26.6) is achievable by unauthenticated remote attackers via HTTP, targeting the Migration component. The attack requires human interaction from a victim - a social engineering or luring condition that constrains opportunistic exploitation - but successful exploitation results in complete compromise of confidentiality, integrity, and availability of the Siebel CRM Deployment instance. No public exploit code has been identified at time of analysis, and this vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog.
Unauthorized data access in Oracle Siebel CRM Integration versions 25.12 through 26.6 allows low-privileged network attackers to read all CRM-accessible data and perform limited data manipulation via HTTP against the Open Integration component, with a confirmed scope change extending impact to additional integrated products. The vulnerability is tagged by Oracle as an Authentication Bypass, enabling a valid but low-privileged account to exceed its authorized access boundaries without elevated complexity or user interaction. No public exploit has been identified at time of analysis, but the combination of low attack complexity, network accessibility, and scope change makes this a credible high-priority threat in enterprise Siebel deployments.
Oracle Siebel CRM Integration versions 25.12-26.6 exposes a high-severity authentication bypass in its Open Integration component that permits an unauthenticated attacker on the same physical network segment to fully read and modify all data accessible through the integration layer. The CVSS 8.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) confirms low-complexity, credential-free exploitation, though the adjacent-network requirement materially constrains the attacker population to insiders or laterally-moved threat actors. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Integrity and availability compromise in Oracle Siebel CRM Integration's Open Integration component (versions 25.12 through 26.6) allows a high-privileged remote attacker over HTTP to corrupt or destroy critical data and trigger a complete denial of service, with confirmed scope change meaning successful exploitation may cascade into additional integrated downstream products. The attack requires high complexity and pre-existing administrative privileges, limiting opportunistic exploitation, but the cross-system blast radius elevates overall business risk. No public exploit code has been identified and this vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Unauthorized data disclosure in Oracle Siebel CRM Integration (versions 25.12 through 26.6) allows a low-privileged authenticated attacker to access critical or complete CRM data via HTTP by exploiting an authentication bypass in the Open Integration component. The scope change (S:C) in the CVSS vector means successful exploitation can extend data exposure beyond Siebel CRM Integration to additional integrated Oracle products. No public exploit code or CISA KEV listing exists at time of analysis, but the low attack complexity and no user-interaction requirement make this readily actionable for any attacker holding even minimal valid credentials.
Full compromise of Oracle Siebel CRM Integration (Open Integration component) is possible by an unauthenticated remote attacker over HTTP, per Oracle's August 2026 Critical Patch Update. Affected releases span Siebel CRM Integration 25.12 through 26.6, and successful exploitation yields complete takeover of the Integration component with full confidentiality, integrity, and availability impact (CVSS 9.8). No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the unauthenticated, low-complexity network profile makes it a high-priority patch item.
Remote authentication bypass in Oracle Siebel CRM Integration (Open Integration component, versions 25.12-26.6) allows unauthenticated network attackers via HTTP to achieve full confidentiality and integrity compromise of CRM data when a victim user interacts with attacker-controlled content. The vulnerability enables unauthorized read, create, delete, and modification access to all Siebel CRM Integration accessible data. Tagged as an Authentication Bypass by Oracle and scored CVSS 8.1 (High), no public exploit code or CISA KEV listing has been identified at time of analysis.
Siebel CRM Integration versions 25.12 through 26.6 expose a network-exploitable flaw in the Open Integration component that permits a low-privileged attacker to achieve full system takeover via crafted HTTP requests under high-complexity conditions. The CVSS 3.1 score of 8.5 reflects a scope change (S:C) alongside full confidentiality, integrity, and availability impact, meaning successful exploitation can cascade to other Oracle and third-party systems connected through the integration layer. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed the issue in the August 2026 Critical Security Patch Update.
Authentication bypass in Oracle Siebel CRM Integration (Open Integration component, versions 25.12-26.6) allows a remote unauthenticated attacker reachable over HTTP to gain unauthorized read and write access to critical CRM data, with a confirmed scope change meaning successful exploitation can cascade to impact additional integrated systems beyond Siebel itself. The AC:H rating indicates exploitation is difficult and likely requires meeting specific environmental or timing conditions, tempering the urgency implied by the 8.7 CVSS score. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Full compromise of Oracle Siebel CRM Integration (Open Integration component) is achievable by a low-privileged, network-based attacker over HTTP, with a scope change that lets attacks significantly impact additional products beyond the vulnerable component. Affected releases span 25.12 through 26.6, and Oracle rates it CVSS 3.1 9.9 with full confidentiality, integrity, and availability loss (component takeover). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of low attack complexity, low privilege requirement, and scope change makes it a top-tier patch priority.
Unauthorized data access and partial data manipulation in Oracle Siebel CRM's Data Archival component exposes critical CRM data to low-privileged network attackers via HTTP. Affected versions 25.12 through 26.6 allow an authenticated low-privileged user to gain complete read access to all Siebel CRM Administration accessible data and perform unauthorized write operations on a subset of that data. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though the 'Authentication Bypass' tag suggests the flaw enables privilege escalation beyond the attacker's authorized scope within the application.
Unauthenticated network exploitation of the Data Archival component in Oracle Siebel CRM Administration exposes complete CRM data to unauthorized access over HTTP. Affecting versions 25.12 through 26.6, the vulnerability carries a CVSS 3.1 score of 8.6 with a confirmed scope change, meaning successful exploitation can cascade to impact additional Oracle or integrated enterprise products beyond the Siebel CRM Administration interface itself. No public exploit or CISA KEV listing has been identified at time of analysis, but the zero-authentication, low-complexity attack surface makes this a high-priority patching target for any organization with internet-exposed Siebel administrative interfaces.
Remote takeover of Oracle Siebel CRM Administration is possible via its Data Archival component, where an unauthenticated attacker with only HTTP network access can fully compromise the module. Oracle rates this CVSS 9.8 with high confidentiality, integrity, and availability impact, and it was disclosed in the August 2026 Oracle Critical Patch Update. At time of analysis there is no public exploit identified and no CISA KEV listing, but the trivial exploitability (AV:N/AC:L/PR:N/UI:N) makes it a high-priority patch for Siebel operators.
Privilege escalation to full takeover in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3 through 26.6) lets a low-privileged attacker with only HTTP network access fully compromise the application and, because of a scope change, meaningfully impact additional connected products. Oracle rates it CVSS 3.1 9.9 with high confidentiality, integrity, and availability impact; it was disclosed in the Oracle Critical Patch Update of August 2026. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Compromise of Oracle Siebel CRM Cloud Applications (versions 22.3-26.6) is achievable by a low-privileged, network-authenticated attacker over HTTP targeting the Siebel Cloud Manager component. Successful exploitation yields unauthorized creation, deletion, or modification of critical CRM data (high integrity impact), partial unauthorized read of CRM data (low confidentiality impact), and the ability to cause a complete, repeatable denial-of-service crash of the application. No public exploit code and no CISA KEV listing are confirmed at time of analysis; EPSS data was not supplied in the source intelligence.
Local privilege escalation in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) enables a low-privileged attacker with logon access to the hosting infrastructure to fully compromise the application via the Siebel Cloud Manager component. Successful exploitation results in complete application takeover with high confidentiality, integrity, and availability impacts. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated remote compromise of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) is possible through the Siebel Cloud Manager component via crafted HTTP requests, requiring no privileges or user interaction. An attacker can gain full read access to all Siebel CRM Cloud data, perform limited unauthorized writes, and cause a partial denial of service, and because the flaw carries a scope change, exploitation can significantly impact additional connected products beyond Siebel itself. Rated CVSS 9.9; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated adjacent-network exploitation of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) via the Siebel Cloud Manager component allows complete read and write access to all CRM data without credentials. The CVSS vector (AV:A/AC:L/PR:N/UI:N) confirms low-complexity, zero-authentication exploitation, constrained only by the requirement for physical or logical adjacency to the target network segment. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the authentication bypass tag and high integrity/confidentiality impact make this a serious concern for any environment with exposed CRM infrastructure.
Full application takeover in Oracle Siebel CRM Cloud Applications (versions 22.3-26.6) is achievable by any low-privileged, network-accessible attacker via HTTP against the Siebel Cloud Manager component, with no user interaction required. Oracle classifies this as 'easily exploitable' and the CVSS vector confirms high impact across confidentiality, integrity, and availability - consistent with a complete system compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range across four years of releases materially raises real-world risk for unpatched enterprise deployments.
Local privilege abuse in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) allows a low-privileged OS-level user on the hosting infrastructure to compromise the Siebel Cloud Manager component, achieving full read access to all CRM application data and limited write access, with a confirmed scope change extending impact to additional co-hosted products. The attack vector is local infrastructure access, making this primarily an insider threat or post-compromise lateral movement risk rather than an external internet-facing exposure. No public exploit has been identified, and Oracle addressed this vulnerability in the August 2026 Critical Patch Update (CPU Aug 2026).
High-privileged remote exploitation of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) via the Siebel Cloud Manager component enables full confidentiality and integrity compromise of Siebel data, with a documented scope change allowing cascading impact on additional Oracle products in the environment. Oracle's August 2026 Critical Security Patch Update discloses a CVSS 3.1 base score of 8.7, reflecting network-accessible exploitation requiring no interaction but demanding high-privilege credentials. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Siebel Cloud Manager in Oracle Siebel CRM Cloud Applications exposes a network-accessible, low-complexity attack path that allows any low-privileged authenticated user to fully take over the application via HTTP. Affected versions span 22.3 through 26.6, a multi-year range covering a substantial portion of the deployed base. No public exploit has been identified at time of analysis; however, Oracle's own characterization of this as 'easily exploitable' and the complete C/I/A impact make this a high-priority remediation target from the August 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3-26.6) allows a low-privileged, network-authenticated attacker to read the entirety of accessible CRM data and perform limited unauthorized data writes via standard HTTP requests. The vulnerability carries a confirmed scope change, meaning successful exploitation of the Siebel Cloud Manager component can cascade to compromise data in additional integrated Oracle products beyond the initial target. No public exploit code has been identified at time of analysis, but the low attack complexity combined with only a low-privilege requirement makes this a realistic and urgent patching priority for any organization running a Siebel CRM Cloud deployment.
Unauthorized data access and manipulation in Oracle Siebel CRM Cloud Applications (versions 22.3-26.6) is achievable by low-privileged, network-connected attackers via HTTP against the Siebel Cloud Manager component. Successful exploitation grants complete read access to all CRM data and the ability to create, delete, or modify critical records, with no availability disruption to the service itself. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low attack complexity and low privilege requirement lower the bar for a targeted threat actor with valid credentials.
Full application takeover in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 through 26.6, lets a remote unauthenticated attacker fully compromise the system over HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) with a 9.8 base score and full high impact on confidentiality, integrity, and availability marks this as a pre-authentication, network-reachable critical flaw disclosed in Oracle's August 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivially-exploitable, unauthenticated profile makes it a high-priority patch target.
Privilege-based takeover of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) is possible via the Siebel Cloud Manager component, where a low-privileged attacker with HTTP network access can fully compromise the application. Because the flaw carries a scope change, successful attacks can significantly impact additional connected products beyond Siebel itself. Rated CVSS 3.1 9.9 with full confidentiality, integrity, and availability impact; no public exploit identified at time of analysis.
Unauthenticated remote exploitation of Oracle Siebel CRM Integration's REST component across versions 17.0 through 26.6 can yield complete loss of data confidentiality and integrity. Tagged as an authentication bypass, the vulnerability permits network-accessible attackers to read all CRM data and perform unauthorized create, delete, or modify operations without credentials. No public exploit has been identified at time of analysis, and Oracle's August 2026 Critical Patch Update addresses the issue.
Unauthorized access to critical CRM data and partial data manipulation in Oracle Siebel CRM Deployment (versions 17.0-26.6) is achievable via the Migration component by any low-privileged attacker with HTTP network access, with a documented scope change indicating that successful exploitation can cascade to affect additional Oracle products beyond the directly targeted component. The CVSS 3.1 base score of 8.5 reflects low attack complexity and no user interaction requirement, making exploitation straightforward for any holder of a valid low-privilege credential. No public exploit has been identified at time of analysis and no CISA KEV listing exists, though the breadth of affected versions spanning nearly a decade of releases represents substantial organizational exposure.
Oracle Siebel CRM Integration's REST component (versions 17.0 through 26.6) contains an authentication bypass flaw enabling unauthenticated network attackers to fully compromise data confidentiality and integrity over HTTPS. The 'Authentication Bypass' tag from the Oracle reporter confirms the vulnerability class: an attacker who satisfies the high-complexity exploitation condition can read all CRM data and perform unauthorized creation, modification, or deletion of records. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog at time of analysis.
Unauthenticated remote access to Oracle Siebel CRM Integration's REST component (versions 17.0 through 26.6) exposes all CRM integration data to unauthorized disclosure and enables partial denial of service via plain HTTP. The vulnerability requires no credentials, no user interaction, and no special configuration beyond the REST interface being reachable, making it exploitable by any network-adjacent or internet-facing attacker. No public exploit has been identified at time of analysis, but Oracle's Critical Patch Update for August 2026 confirms the issue and its severity classification of CVSS 8.2.
Oracle Siebel CRM Deployment's Server Infrastructure component exposes versions 17.0 through 26.6 to an unauthenticated, network-based authentication bypass over HTTP that can result in complete compromise of CRM data confidentiality and integrity. The high complexity rating (AC:H) tempers immediate mass-exploitation risk, but the Authentication Bypass tag combined with C:H and I:H impact means a successful attacker achieves full read and write access to all CRM-accessible data - including customer records, sales pipelines, and service data - without presenting valid credentials. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle's Critical Security Patch Update for August 2026 addresses this vulnerability.
Oracle Siebel CRM Deployment's Application Interface component (versions 17.0 through 26.6) exposes complete read and write access to all CRM data to unauthenticated attackers positioned on the adjacent network segment. The CVSS vector confirms zero authentication requirements and low attack complexity, meaning any actor with access to the physical communication segment hosting the Siebel server can silently exfiltrate or corrupt the entire CRM dataset. No active exploitation has been confirmed in the CISA KEV catalog and no public exploit code has been identified at time of analysis, but the authentication bypass classification combined with high confidentiality and integrity impact makes this a credible priority for organizations with insufficiently segmented internal networks.
Remote authentication bypass in Oracle Siebel CRM Integration's REST component affects all supported versions from 17.0 through 26.6, enabling unauthenticated network attackers to achieve full read and write access to critical CRM data via crafted HTTPS requests. The vulnerability is tagged Authentication Bypass, indicating that REST API access controls can be circumvented without credentials despite a high attack complexity (AC:H) rating that suggests exploitation requires precise crafting or internal state knowledge. No public exploit identified at time of analysis, but the combination of unauthenticated access and high confidentiality and integrity impact warrants priority patching under Oracle's August 2026 Critical Patch Update.
Unauthenticated adjacent-network exploitation of Oracle Siebel CRM's Search component allows complete read and write access to all CRM data across versions 17.0 through 26.6. Successful exploitation enables creation, deletion, and modification of critical data as well as full confidentiality compromise without any prior authentication or user interaction. No public exploit identified at time of analysis, and this vulnerability is not currently listed in CISA KEV, though its low-complexity, unauthenticated nature makes it a credible priority for organizations with exposed Siebel deployments.
Unauthorized data access in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 through 26.5, lets an unauthenticated remote attacker over HTTP read all Siebel-accessible data, tamper with some records, and cause a partial denial of service. Oracle rates it CVSS 7.0 but flags it as difficult to exploit (AC:H), and no public exploit identified at time of analysis. Disclosed via the Oracle July 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 through 26.5, lets a remote unauthenticated attacker reach sensitive data over HTTP. The flaw is tagged as an authentication bypass and, per Oracle's own scoring, is 'easily exploitable' with a high confidentiality impact but no integrity or availability effect (CVSS 3.1 base 7.5). No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided in the source data.
Unauthorized data access in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3 through 26.5) allows a low-privileged attacker with network HTTP access to read all data accessible to the application. Oracle rates it CVSS 3.1 7.7 with a scope change, and the ENISA EUVD flags an authentication-bypass characteristic, meaning a minimally-authenticated actor can escalate to broad confidentiality compromise that spills into additional connected products. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data access in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3 through 26.5) lets a remote, unauthenticated attacker reach and read critical application data over HTTP. Oracle rates this CVSS 3.1 7.5 with confidentiality-only impact, and the intelligence tags flag it as an authentication-bypass class issue, so attackers can obtain complete access to all data accessible to the affected applications without credentials. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Unauthorized data access and manipulation is possible in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.5) via a flaw in the Siebel Cloud Manager component, tagged as an Authentication Bypass. An unauthenticated attacker positioned on the same physical network segment as the hosting hardware can, under high-complexity conditions, read a subset of accessible CRM data and perform unauthorized inserts or modifications. No confirmed active exploitation (CISA KEV) and no public proof-of-concept have been identified at time of analysis, and the CVSS 4.2 score accurately reflects the constrained adjacency and complexity requirements.
Unauthorized data manipulation via authentication bypass in Oracle Siebel CRM Integration's Siebel Server Sync for Exchange component allows unauthenticated remote attackers to insert, update, or delete a subset of CRM-accessible data over HTTP. All versions from 17.0 through 26.5 are affected, with exploitation constrained by high attack complexity that substantially reduces real-world risk. No public exploit code or active exploitation has been identified at time of analysis, consistent with the low CVSS score of 3.7 reflecting limited, integrity-only impact.
Unauthenticated information disclosure in Oracle Siebel CRM's End User User Interface component allows remote attackers to read a subset of CRM data over HTTP without credentials. Versions 25.0 through 25.5 are confirmed affected. Oracle has released a fix in the July 2025 Critical Patch Update; no public exploit or active exploitation has been identified at time of analysis.
Vulnerability in the Siebel CRM product of Oracle Siebel CRM (component: UI Framework). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the Siebel CRM product of Oracle Siebel CRM (component: Siebel Core - Server Infrastructure). Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Vulnerability in the Siebel Core - DB Deployment and Configuration product of Oracle Siebel CRM (component: Install - Configuration). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Siebel Core - Server BizLogic Script component of Oracle Siebel CRM (subcomponent: Integration - Scripting). Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, low attack complexity.
Unspecified vulnerability in the Siebel Core - Server Framework component in Oracle Siebel CRM IP2014 and IP2015 allows remote attackers to affect confidentiality via unknown vectors related to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1, 8.22, and 15.0 allows remote authenticated users to affect confidentiality via vectors related to UIF Open. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable.
Unspecified vulnerability in the Siebel Core - Server OM Svcs component in Oracle Siebel CRM 8.1.1, 8.2.2, and 15.0 allows remote attackers to affect confidentiality via vectors related to LDAP. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Unspecified vulnerability in the Siebel Core - Server OM Svcs component in Oracle Siebel CRM 8.1.1, 8.2.2, and 15.0 allows remote authenticated users to affect confidentiality via unknown vectors. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1, 8.2.2, and 15.0 allows remote attackers to affect integrity via vectors related to SWSE Server. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1 and 8.2 allows remote attackers to affect integrity via unknown vectors related to Portal Framework. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Oracle Enterprise Asset Management component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Portal Framework,. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Portal. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity.
Unspecified vulnerability in the Siebel Core - Server BizLogic Script component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect integrity via vectors related to Integration -. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Unspecified vulnerability in the Siebel Life Sciences component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unspecified vulnerability in the Siebel Core - Server BizLogic Script component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality, integrity, and. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Portal. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unspecified vulnerability in the Siebel Core - Server OM Services component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via vectors related to. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unspecified vulnerability in the Siebel Public Sector component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect integrity via unknown vectors related to Public Sector. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect integrity via unknown vectors related to AX/HI Web UI. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel Core - EAI component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Java Integration, a. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity.
Unspecified vulnerability in the Siebel Core - Server Infrastructure component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel Core - EAI component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect availability via unknown vectors related to Integration. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel Core EAI component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect availability via unknown vectors related to Integration. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unspecified vulnerability in the Siebel Core - Common Components component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect integrity via unknown vectors related to Portal Framework. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel Core - System Management component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity.
Unspecified vulnerability in the Siebel Core - Server OM Frwks component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel Travel & Transportation component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect integrity via unknown vectors related to Diary. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect integrity via vectors related to Open_UI, a different. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect integrity via unknown vectors related to Portal Framework, a. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect integrity via unknown vectors related to Portal Framework, a. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel Core - EAI component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows local users to affect confidentiality via unknown vectors related to Integration Business. Rated low severity (CVSS 1.4), this vulnerability is low attack complexity. No vendor patch available.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect integrity via vectors related to Open_UI, a different. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel Life Sciences component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect availability via unknown vectors related to Clinical. Rated low severity (CVSS 2.8), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel Core - EAI component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Java Integration, a. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unspecified vulnerability in the Siebel Core - Server Infrastructure component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect availability via vectors related to SISNAPI &. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality, integrity, and availability via vectors related. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel Core - EAI component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect availability via unknown vectors related to Web Services. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel Core - EAI component in Oracle Siebel CRM 8.1.1 allows remote authenticated users to affect availability via unknown vectors related to Web Services. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity.
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect integrity via unknown vectors related to ActiveX. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unspecified vulnerability in the Siebel Core - Server BizLogic Script component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality and integrity via unknown. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable. No vendor patch available.
Unspecified vulnerability in the Siebel Core - EAI component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Web Services. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity.
Unspecified vulnerability in the Siebel Core - EAI component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Web. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity.