CVE-2026-70855 in Siebel Apps Self Service
Summary
by MITRE • 08/19/2026
Vulnerability in the Siebel Apps - Self Service product of Oracle Siebel CRM (component: Helpdesk/Training). Supported versions that are affected are 17.0-26.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Self Service. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel Apps - Self Service, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel Apps - Self Service accessible data as well as unauthorized access to critical data or complete access to all Siebel Apps - Self Service accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Helpdesk and Training components of Oracle Siebel CRM, specifically affecting the Self Service product module across supported versions ranging from 17.0 to 26.6. This security flaw represents a critical risk due to its potential for remote exploitation by unauthenticated actors who possess network access via HTTP protocols. The core technical deficiency allows an attacker to compromise the integrity and confidentiality of data stored within the Siebel environment without requiring valid credentials, which is particularly concerning given that Self Service portals are often exposed directly to external users or partners as part of standard business operations.
The exploitation mechanism for this vulnerability relies on a combination of low complexity requirements and social engineering elements. While the technical barrier to entry is minimal due to the lack of authentication required at the network level, successful execution necessitates human interaction from a victim other than the attacker. This characteristic aligns with common attack vectors such as cross-site scripting or malicious content injection where an unsuspecting user must perform an action that triggers the exploit within their browser session against the Siebel application. The requirement for user interaction does not mitigate the severity but rather shifts the burden of initial access to social engineering tactics, making detection and prevention reliant on both technical controls and user awareness training.
The operational impact of this vulnerability is severe, characterized by a significant scope change that extends beyond the immediate Self Service module. A successful compromise can lead to unauthorized creation, deletion, or modification of critical data within the Siebel ecosystem. Furthermore, it grants attackers complete access to all data accessible through the Siebel Apps - Self Service interface. This level of access effectively breaks the isolation boundaries between modules, allowing an attacker who targets one component to pivot and impact additional products integrated with the central CRM database. The ability to alter critical records undermines business continuity, financial accuracy, and customer trust, while unauthorized data exfiltration poses substantial regulatory compliance risks under frameworks such as GDPR or HIPAA depending on the nature of the stored information.
From a classification perspective, this vulnerability maps closely to CWE-79 for Cross-Site Scripting if the vector involves browser-based injection, or potentially CWE-284 for Improper Access Control if it stems from flawed authorization logic in the API layer. In terms of offensive security frameworks like MITRE ATT&CK, this behavior is consistent with techniques involving Valid Accounts exploitation through social engineering (T1078) and Data Exfiltration over Web Services (T1567). The high confidentiality and integrity impacts reflected in the CVSS 3.1 Base Score of 9.3 underscore the urgent need for remediation, as the attack vector allows an unauthenticated user to achieve near-total control over sensitive business data with minimal effort once a victim is engaged.
Mitigation strategies must prioritize immediate patching of all affected Siebel versions to version 26.7 or later where available, ensuring that Oracle Security Alerts are applied promptly. In environments where patching cannot be implemented immediately due to operational constraints, network-level controls should be enforced to restrict HTTP access to the Helpdesk and Training components exclusively from trusted IP ranges using firewalls or web application firewalls. Additionally, implementing strict Content Security Policy headers can help mitigate potential script injection vectors if they are part of the exploitation chain. Regular security awareness training for employees who interact with Self Service portals is also essential to reduce the likelihood of successful social engineering attempts that trigger this vulnerability. Continuous monitoring of access logs for anomalous patterns indicative of unauthenticated data manipulation or bulk retrieval operations will aid in early detection and response to potential active exploits.