CVE-2026-60689
Summary
by MITRE • 07/22/2026
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Siebel CRM Cloud Applications, specifically in the Siebel Cloud Manager component, affecting versions ranging from 22.3 through 26.5. The flaw represents a significant security weakness that operates under the Common Weakness Enumeration framework as a weakness related to insufficient authentication mechanisms and potentially inadequate access controls. The vulnerability's exploitability is classified as easily exploitable, indicating that attackers require minimal technical skills or resources to leverage this weakness effectively.
The technical nature of this vulnerability stems from the system's failure to properly authenticate incoming requests through HTTP connections, creating an unauthenticated access vector that allows malicious actors to bypass normal security controls. This weakness falls under the ATT&CK framework's privilege escalation and initial access categories, where adversaries can establish unauthorized access without requiring valid credentials or prior system compromise. The CVSS 3.1 scoring of 7.5 reflects the high severity impact on confidentiality, indicating that successful exploitation could lead to unauthorized access to critical data or complete access to all data within the Siebel CRM Cloud Applications environment.
The operational impact of this vulnerability extends beyond simple data theft, as it potentially allows attackers to gain complete control over the affected applications and their associated data repositories. Organizations utilizing affected Siebel CRM versions face substantial risk exposure where sensitive customer information, business records, and proprietary data could be accessed without authorization. The absence of authentication requirements for HTTP-based access creates a persistent threat surface that could be exploited by automated scanning tools or determined adversaries seeking to compromise enterprise CRM systems.
Organizations should immediately implement mitigations including network-level restrictions such as firewall rules limiting access to the affected components, implementing additional authentication layers, and considering the deployment of web application firewalls to monitor and filter HTTP traffic. The vulnerability's classification under CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N indicates that attackers can exploit this weakness from a network location without requiring any privileges or user interaction, making it particularly dangerous for cloud-based applications where exposure to external networks is common. Security teams should prioritize patching affected systems according to Oracle's security advisory releases and consider implementing network segmentation strategies to limit the potential blast radius of such an attack. Additionally, monitoring for unusual HTTP traffic patterns and unauthorized access attempts should be enhanced as part of the defensive posture to detect potential exploitation attempts.