CVE-2026-60712 in Siebel CRM Cloud Applications
Summary
by MITRE • 07/22/2026
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications. While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle Siebel CRM Cloud Applications, specifically within the Siebel Cloud Manager component, affecting versions ranging from 22.3 through 26.5. The flaw represents a significant security weakness that can be exploited by attackers with minimal privileges who already possess legitimate access to the underlying infrastructure where the applications operate. The CVSS 3.1 scoring system assigns this vulnerability a base score of 6.5, classified as a medium severity issue with high confidentiality impact, indicating that successful exploitation could lead to unauthorized access to sensitive data or complete disclosure of all accessible information within the Siebel CRM environment.
The technical nature of this vulnerability stems from inadequate access controls or privilege management within the Siebel Cloud Manager component, allowing an attacker with low-privilege credentials to escalate their access and compromise the entire Siebel CRM application ecosystem. The attack vector is assessed as local access (AV:L) meaning that exploitation requires physical or network-level access to the infrastructure hosting the applications, while the low complexity requirement (AC:L) suggests that the attack can be executed without significant technical expertise. The privilege requirement is also minimal (PR:L), indicating that an attacker only needs basic user credentials rather than administrative privileges to launch this assault.
The operational impact of this vulnerability extends beyond the immediate Siebel CRM applications and can potentially affect related systems through what is termed "scope change" in the vulnerability description, meaning that successful exploitation might enable attackers to compromise additional products within the broader Oracle ecosystem or connected applications. This cascading effect significantly amplifies the potential damage, as it could allow an attacker to move laterally across multiple systems and applications that may share common infrastructure components or user access controls.
The confidentiality impact is rated as high (C:H) which indicates that successful exploitation could result in complete disclosure of all sensitive information within the Siebel CRM environment, potentially exposing customer data, business records, proprietary information, and other critical assets. The lack of integrity (I:N) and availability (A:N) impacts suggest that while the primary concern is unauthorized data access, the vulnerability does not appear to directly enable modification of data or disruption of service availability. However, the scope change component (S:C) indicates that the attack could potentially expand beyond the original target, affecting additional systems or applications.
Organizations should immediately implement mitigations including comprehensive access control reviews, privilege management updates, and enhanced monitoring of user activities within the Siebel CRM environment. The vulnerability aligns with CWE-284 which describes improper access control scenarios where systems fail to properly enforce access restrictions, and may relate to ATT&CK technique T1078 for valid accounts and T1566 for social engineering, though the specific attack vector appears more focused on infrastructure-level privilege escalation. Security teams should prioritize patching affected systems, implementing network segmentation, and establishing robust audit trails to detect potential exploitation attempts.
According to industry best practices and security frameworks, this vulnerability represents a critical concern for organizations maintaining sensitive customer relationship management data within Oracle Siebel environments. The combination of local access requirements with high confidentiality impact makes this particularly dangerous in environments where insider threats or compromised user accounts are possible. Organizations should also consider implementing additional controls such as privileged access management solutions, continuous monitoring systems, and regular security assessments to reduce the risk of successful exploitation. The vulnerability demonstrates the importance of maintaining up-to-date security patches and proper access control configurations, as even minor privilege escalation flaws can lead to significant data breaches within enterprise CRM systems.