CVE-2026-60751 in Siebel Apps
Summary
by MITRE • 08/19/2026
Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Apps - Marketing. Successful attacks of this vulnerability can result in takeover of Siebel Apps - Marketing. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Marketing component of Oracle Siebel CRM, specifically affecting supported versions ranging from 17.0 through 26.6. This security flaw represents a critical risk to organizations relying on this enterprise customer relationship management platform for their marketing operations and data integrity. The nature of the defect allows an attacker with low privileges who possesses network access via HTTP to exploit the system remotely without requiring user interaction or complex preconditions. Such ease of exploitation significantly lowers the barrier to entry for malicious actors, enabling them to bypass standard authentication mechanisms that would typically restrict access to sensitive administrative functions or proprietary business data within the Siebel environment.
From a technical perspective, this vulnerability facilitates unauthorized takeover of the Siebel Apps - Marketing application instance. The ability to compromise the system at this level implies that an attacker can execute arbitrary code or manipulate core application logic with elevated privileges effectively equivalent to those of a high-level administrator. This outcome aligns closely with CWE-269, which describes Improper Privilege Management, as well as CWE-78, the OS Command Injection vulnerability type if the exploitation involves executing system commands through the web interface. The remote nature of the attack vector means that physical proximity or local access is not required, allowing for widespread automated attacks against exposed instances on public networks.
The operational impact of this compromise is severe and multifaceted, encompassing breaches in confidentiality, integrity, and availability as reflected by its high CVSS 3.1 base score of 8.8. In terms of confidentiality, the attacker gains access to sensitive customer data, marketing strategies, and proprietary business intelligence stored within the Siebel database. Regarding integrity, the ability to take over the application allows for the modification or deletion of critical records, leading to corrupted analytics and flawed decision-making processes based on manipulated data. Furthermore, availability is impacted as attackers may deploy ransomware, deface web interfaces, or exhaust system resources through denial-of-service techniques, rendering the marketing platform inaccessible to legitimate users and disrupting business continuity.
In alignment with the MITRE ATT&CK framework, this vulnerability facilitates initial access via network services (T1071) followed by privilege escalation (T1068). The attacker can leverage these capabilities to establish persistence within the corporate network, potentially using Siebel as a pivot point for further lateral movement toward more critical infrastructure. This scenario highlights the importance of treating all internet-facing applications with rigorous security controls regardless of their perceived internal role.
To mitigate this risk, organizations must immediately apply the latest security patches provided by Oracle for the affected versions of Siebel CRM Marketing. Until patching is feasible, implementing strict network segmentation to restrict HTTP access to only authorized IP addresses can reduce the attack surface. Additionally, deploying a Web Application Firewall with rules specifically tuned to detect exploitation patterns associated with this vulnerability type can provide an additional layer of defense. Regular audits of user privileges and monitoring for anomalous administrative activities are also recommended to detect potential compromise early in the kill chain.