CVE-2026-70857 in Siebel CRM End User
Summary
by MITRE • 08/19/2026
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.6. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTPS to compromise Siebel CRM End User. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel CRM End User, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM End User accessible data as well as unauthorized access to critical data or complete access to all Siebel CRM End User accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Open UI component of Oracle Siebel CRM, specifically affecting end-user versions ranging from 17.0 through 26.6. This flaw represents a significant security risk due to its potential for remote code execution and data manipulation via standard web protocols. The core technical nature of this issue involves a logic error or improper validation within the Open UI framework that allows an attacker with low privileges to manipulate client-side interactions in ways that bypass intended access controls. Although the vulnerability is technically located in the end-user interface layer, its exploitation can lead to scope changes where additional backend products and services are impacted due to shared authentication contexts or integrated data flows typical of enterprise CRM architectures.
Exploitation of this vulnerability requires a specific set of conditions that distinguish it from high-severity remote code execution flaws. The attack vector is network-based via HTTPS, meaning the attacker does not need physical access or local shell access to initiate the compromise. However, the complexity factor is rated as difficult, indicating that successful exploitation likely involves crafting sophisticated requests or leveraging complex state transitions within the application logic. Crucially, this vulnerability requires human interaction from a victim other than the attacker. This characteristic aligns with social engineering vectors such as phishing or malicious link delivery, where an authenticated user must perform a specific action to trigger the exploit chain. The requirement for user interaction significantly raises the barrier to entry for automated scanning tools but does not mitigate the severity once a targeted individual is engaged.
The operational impact of this vulnerability is severe, primarily affecting confidentiality and integrity while leaving availability largely intact according to the CVSS 3.1 scoring model which assigns a base score of 7.7. A successful exploit allows an unauthorized actor to create, delete, or modify critical data within the Siebel CRM environment. This includes sensitive customer information, sales pipelines, financial records, and other proprietary business intelligence stored in the system. Furthermore, it grants unauthorized access to this data, potentially leading to significant regulatory compliance violations under frameworks such as GDPR or HIPAA if personal health or financial data is exposed. The ability to modify critical data poses a direct threat to business continuity and decision-making integrity, as attackers could alter records to mask their activities or disrupt operational workflows.
From an industry standard perspective, this vulnerability maps closely to CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-Site Scripting if the vector involves script injection, or potentially CWE-200 Exposure of Sensitive Information if it primarily facilitates data exfiltration. In terms of MITRE ATT&CK tactics, this aligns with Initial Access through Phishing due to the human interaction requirement and subsequent Privilege Escalation or Credential Access depending on how low privileges are leveraged into higher-level access. The scope change aspect suggests that lateral movement within the broader Oracle ecosystem is possible, amplifying the blast radius beyond the immediate Siebel instance.
Mitigation strategies must address both technical controls and user awareness programs. Immediate remediation involves applying the latest security patches provided by Oracle for all supported versions of Siebel CRM between 17.0 and 26.6. Organizations should prioritize patching systems that are exposed to external networks or accessible by untrusted users. In addition to patching, implementing strict Content Security Policy headers can help mitigate potential script injection vectors associated with Open UI flaws. Network segmentation should be reviewed to ensure that the Siebel CRM environment is isolated from less secure network zones, limiting the ability of an attacker who gains initial foothold via user interaction to pivot to other critical systems. Furthermore, security awareness training for end-users is essential to reduce the success rate of social engineering attacks that trigger this vulnerability, emphasizing caution when interacting with unexpected links or forms within the CRM interface.