Description
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Installation). Supported versions that are affected are 17.0-26.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in takeover of Siebel CRM Deployment. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-08-18
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the Installation component of Oracle Siebel CRM Deployment allows an attacker who has a low‑privileged account and can log into the host running the product to exploit the vulnerability. The exploitation can lead to full takeover of the deployment, exposing, modifying, or deleting sensitive customer data and disrupting service. The impact covers confidentiality, integrity, and availability as reflected in a CVSS base score of 7.8.

Affected Systems

Oracle Siebel CRM Deployment versions 17.0 through 26.6 inclusive are affected. The vulnerability applies to the installation component of the product.

Risk and Exploitability

The CVSS vector states a local attack (AV:L) with low privilege (PR:L) and no user interaction (UI:N). Exploitation requires only low‑privileged host access and is considered easily doable. EPSS is less than 1% and the flaw is not in the CISA KEV catalog, indicating no proven widespread exploitation yet, but the high impact and low effort necessitate prompt action.

Generated by OpenCVE AI on August 21, 2026 at 18:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the most recent Oracle Siebel CRM Deployment security patches or upgrade to a version newer than 26.6.
  • Restrict local logon rights on any host running Siebel CRM Deployment to authorized administrators and service accounts only.
  • Enforce strict file and directory permissions on the installation component and disable any unnecessary installation services, following Oracle’s configuration guidance.
  • Monitor audit logs for unauthorized installation attempts and address any alerts in accordance with Oracle’s recommendations.

Generated by OpenCVE AI on August 21, 2026 at 18:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 02 Sep 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Oracle siebel Crm
CPEs cpe:2.3:a:oracle:siebel_crm:*:*:*:*:*:*:*:*
Vendors & Products Oracle siebel Crm

Fri, 21 Aug 2026 18:45:00 +0000

Type Values Removed Values Added
Title Local Privileged Logon Enables Full Compromise of Oracle Siebel CRM Deployment

Fri, 21 Aug 2026 16:15:00 +0000

Type Values Removed Values Added
Title Low-Privilege Logon Compromise Enables Full Siebel CRM Deployment Takeover
Weaknesses CWE-732

Wed, 19 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 18 Aug 2026 23:15:00 +0000

Type Values Removed Values Added
Title Low-Privilege Logon Compromise Enables Full Siebel CRM Deployment Takeover
Weaknesses CWE-284
CWE-732

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Installation). Supported versions that are affected are 17.0-26.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in takeover of Siebel CRM Deployment. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle siebel Crm Deployment
CPEs cpe:2.3:a:oracle:siebel_crm_deployment:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle siebel Crm Deployment
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Siebel Crm Siebel Crm Deployment
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-20T03:56:45.512Z

Reserved: 2026-07-08T15:51:55.587Z

Link: CVE-2026-60753

cve-icon Vulnrichment

Updated: 2026-08-19T19:07:36.571Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:16:41.927

Modified: 2026-09-02T17:33:22.663

Link: CVE-2026-60753

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T18:30:17Z

Weaknesses