CVE-2026-60758 in Siebel Artificial Intelligence
Summary
by MITRE • 08/19/2026
Vulnerability in the Siebel Artificial Intelligence product of Oracle Siebel CRM (component: AI). Supported versions that are affected are 25.12-26.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Artificial Intelligence. While the vulnerability is in Siebel Artificial Intelligence, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel Artificial Intelligence accessible data as well as unauthorized update, insert or delete access to some of Siebel Artificial Intelligence accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Siebel Artificial Intelligence component of Oracle Siebel CRM, specifically affecting supported versions ranging from 25.12 through 26.6. This security flaw represents a significant risk to organizations relying on this enterprise resource planning and customer relationship management suite for their automated decision-making processes and data analytics capabilities. The core technical issue allows an attacker with low privileges who possesses network access via HTTP to compromise the integrity of the Siebel Artificial Intelligence module. Unlike many vulnerabilities that are isolated within specific application layers, this flaw exhibits a scope change characteristic where exploitation can lead to broader system impacts beyond just the AI component itself. This lateral movement potential indicates that the underlying architecture may share critical resources or authentication contexts with other parts of the Oracle ecosystem, thereby amplifying the blast radius of a successful exploit.
From an operational perspective, the impact of this vulnerability is severe due to its high confidentiality and integrity implications while maintaining no direct availability impact according to the CVSS 3.1 scoring model which assigns a base score of 8.5. Successful exploitation enables unauthorized access to critical data stored within or accessible by Siebel Artificial Intelligence. This includes sensitive customer information, proprietary business metrics, and potentially personally identifiable information depending on the organization's deployment configuration. Furthermore, the vulnerability grants attackers the ability to perform unauthorized updates, inserts, or deletes against accessible data sets. This capability allows for both data exfiltration and malicious modification of records, which can lead to financial fraud, regulatory non-compliance, and erosion of trust in automated business processes. The low attack complexity and lack of user interaction requirements make this vulnerability particularly dangerous as it can be exploited remotely by any authenticated but unprivileged network actor without needing social engineering or complex setup procedures.
In terms of industry standard classification, this vulnerability aligns with CWE-269 Improper Privilege Management due to the ability of low-privilege users to perform actions beyond their intended scope, and potentially CWE-862 Missing Authorization if access controls are not properly enforced for specific data endpoints. The attack vector corresponds to ATT&CK technique T1078 Valid Accounts as it leverages legitimate but insufficiently restricted credentials, and the impact on integrity maps to techniques such as T1565 Data Manipulation or T1048 Exfiltration Over Alternative Protocol if HTTP is used for data theft. The scope change aspect suggests a potential violation of isolation boundaries between application components, which may relate to CWE-272 Least Privilege Violations in multi-tenant or modular architectures common in large enterprise software suites.
Mitigation strategies must prioritize immediate patching by Oracle as the primary defense mechanism given the severity and ease of exploitation. Organizations should ensure that all instances of Siebel CRM are updated to a version later than 26.6 where this flaw is resolved. In environments where patching cannot be implemented immediately, network segmentation policies should be reviewed to restrict HTTP access to the AI component from untrusted or low-privilege networks. Implementing strict role-based access control models that adhere to the principle of least privilege can help limit the potential impact if an account with minimal permissions is compromised. Additionally, deploying web application firewalls configured to detect anomalous data manipulation patterns may provide a layer of defense against exploitation attempts while longer-term architectural reviews are conducted to address the scope change vulnerability and ensure better isolation between critical enterprise modules.