CVE-2026-60704 in Siebel CRM Cloud Applications
Summary
by MITRE • 07/22/2026
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Siebel CRM Cloud Applications, specifically in the Siebel Cloud Manager component, affecting versions ranging from 22.3 through 26.5. The flaw represents a significant security weakness that operates at the network level and can be exploited by unauthenticated attackers without requiring any prior authorization or privileged access. The vulnerability's exploitability score of 7.5 on the CVSS 3.1 scale indicates a serious threat level, with the primary impact focused on confidentiality aspects as demonstrated by the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The attack surface is particularly concerning since it allows network-based exploitation through HTTP protocols, meaning that any individual with access to the network can potentially leverage this weakness.
The technical nature of this vulnerability stems from insufficient authentication mechanisms within the Siebel Cloud Manager component, creating an entry point for unauthorized actors to gain access to sensitive data within the CRM environment. This flaw directly violates fundamental security principles and represents a critical design oversight in the application's access control implementation. The absence of proper authentication requirements means that malicious actors can traverse the system boundaries without facing any barriers, effectively removing the first line of defense that should protect enterprise customer data and business-critical information stored within Siebel CRM applications.
The operational impact of this vulnerability extends beyond simple data breaches to encompass complete compromise of accessible data within the Siebel CRM environment. Organizations utilizing affected versions face the risk of unauthorized access to critical business information, including customer records, sales data, financial details, and other confidential business intelligence that forms the backbone of their operations. This exposure can lead to significant financial losses through data theft, regulatory penalties due to compliance violations, and reputational damage from security incidents. The vulnerability's potential for complete data access without any authentication requirements makes it particularly dangerous for enterprises handling sensitive customer information or proprietary business data.
Security professionals should immediately implement mitigation strategies including network segmentation to limit access to affected systems, deployment of web application firewalls to monitor and filter HTTP traffic, and implementation of additional authentication layers where possible. Organizations must also consider immediate patching of affected systems to address the root cause of this vulnerability, as the CVSS score indicates a high-risk exposure that requires urgent attention. The vulnerability aligns with CWE-287 (Improper Authentication) and could be exploited using techniques consistent with ATT&CK tactic TA0006 (Credential Access) and technique T1566 (Phishing). Regular security assessments should be conducted to ensure that similar authentication gaps are not present in other components of the Siebel CRM infrastructure or related systems.