Description
Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: REST). Supported versions that are affected are 17.0-26.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Siebel CRM Integration. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM Integration accessible data as well as unauthorized access to critical data or complete access to all Siebel CRM Integration accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-08-18
Score: 7.4 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Oracle Siebel CRM Integration's REST component contains a vulnerability that permits an unauthenticated attacker with network access via HTTPS to compromise the system. A successful exploitation allows the attacker to create, delete, or modify critical data, and to obtain full access to all data accessible through Siebel CRM Integration. The impact covers both confidentiality and integrity of the system’s data, as reflected in the CVSS 3.1 Base Score of 7.4.

Affected Systems

The affected product is Oracle Siebel CRM Integration, versions 17.0 through 26.6. Any installation of these versions running the REST service is susceptible to the described flaw.

Risk and Exploitability

The CVSS score of 7.4 indicates high severity, and the EPSS score of < 1% indicates a very low exploitation probability. The flaw is exploitable over the network via HTTPS without authentication, and the vulnerability is not listed in CISA’s KEV catalog. Businesses should consider the potential for significant data loss or corruption if the flaw is leveraged.

Generated by OpenCVE AI on August 21, 2026 at 14:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor patch to update Oracle Siebel CRM Integration to a version newer than 26.6
  • Restrict network access to the Siebel CRM Integration REST endpoints by employing firewall rules or a VPN so that only trusted hosts can reach the service
  • Monitor Siebel logs for anomalous creation, deletion, or modification activity to detect possible abuse of the REST interface

Generated by OpenCVE AI on August 21, 2026 at 14:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 26 Aug 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Oracle siebel Crm
CPEs cpe:2.3:a:oracle:siebel_crm:*:*:*:*:*:*:*:*
Vendors & Products Oracle siebel Crm

Fri, 21 Aug 2026 14:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated REST Access Allows Unauthorized Data Manipulation in Oracle Siebel CRM Integration

Wed, 19 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: REST). Supported versions that are affected are 17.0-26.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Siebel CRM Integration. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM Integration accessible data as well as unauthorized access to critical data or complete access to all Siebel CRM Integration accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle siebel Crm Integration
CPEs cpe:2.3:a:oracle:siebel_crm_integration:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle siebel Crm Integration
References
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Siebel Crm Siebel Crm Integration
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-20T03:56:07.751Z

Reserved: 2026-07-08T15:51:55.589Z

Link: CVE-2026-60766

cve-icon Vulnrichment

Updated: 2026-08-19T15:06:18.737Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:16:42.640

Modified: 2026-08-26T15:17:48.680

Link: CVE-2026-60766

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T14:30:07Z

Weaknesses