CVE-2026-60752 in Siebel Apps Marketing
Summary
by MITRE • 08/19/2026
Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Apps - Marketing. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel Apps - Marketing accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Siebel Apps - Marketing. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Marketing component of Oracle Siebel CRM, specifically affecting supported versions ranging from 17.0 through 26.6. This security flaw is classified as a critical issue due to its ease of exploitation and significant impact on system integrity and data confidentiality. The vulnerability allows an attacker with low privileges who possesses network access via HTTP to compromise the application's core functionality. Unlike high-privilege exploits that require deep administrative access, this weakness can be leveraged by users with minimal initial permissions, thereby expanding the potential attack surface significantly within enterprise environments where Siebel CRM is deployed for customer relationship management and marketing automation tasks.
From a technical perspective, the flaw enables unauthorized access to critical data stored within the Marketing module. This indicates that the application fails to properly enforce access control mechanisms when processing HTTP requests related to marketing campaigns or customer data retrieval. The lack of robust validation allows an authenticated but low-privileged user to bypass intended restrictions and view sensitive information such as customer profiles, campaign performance metrics, or proprietary business strategies. Furthermore, the vulnerability includes a partial denial of service capability, suggesting that malicious actors can disrupt normal operations by consuming excessive resources or triggering errors in critical processes, thereby degrading system availability for other legitimate users.
The operational impact of this vulnerability is severe, encompassing both confidentiality and availability breaches as reflected in its CVSS 3.1 base score of 7.1. The high confidence level indicates that sensitive data can be exfiltrated without detection, potentially leading to regulatory non-compliance under frameworks such as GDPR or CCPA if personal identifiable information is exposed. Simultaneously, the partial denial of service capability disrupts business continuity by rendering marketing tools inaccessible during critical periods. This dual impact undermines trust in the platform and may result in financial losses due to operational downtime and potential reputational damage from data leaks.
In terms of industry standard classifications, this vulnerability aligns with CWE-269 Improper Privilege Management or CWE-862 Missing Authorization, depending on whether the exploit relies on privilege escalation or direct access control bypass. The attack vector corresponds to ATT&CK technique T1078 Valid Accounts, as it utilizes legitimate but low-level credentials to gain unauthorized access. Additionally, the denial of service aspect relates to ATT&CK tactic TA0040 Impact and potentially technique T1499 Endpoint Denial of Service if resource exhaustion is achieved through application logic flaws rather than network flooding.
Mitigation strategies must prioritize immediate patching by Oracle for all affected Siebel CRM versions between 17.0 and 26.6. Organizations should apply the latest security updates provided in official advisories to close these access control gaps. In addition to software patches, implementing strict input validation on HTTP endpoints handling marketing data can help mitigate exploitation attempts. Network segmentation should be enforced to limit direct HTTP access from untrusted zones to Siebel servers, and multi-factor authentication should be required for all user accounts to reduce the risk of credential-based attacks. Continuous monitoring of application logs for anomalous access patterns related to low-privileged users accessing sensitive marketing data is also recommended to detect potential exploitation attempts in real time.