Description
Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Apps - Marketing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel Apps - Marketing accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel Apps - Marketing. CVSS 3.1 Base Score 8.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).
Published: 2026-08-18
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw is a permission error (CWE‑284) that permits a low‑privileged attacker with network access over HTTP to create, delete, or modify any Siebel Apps – Marketing data. The vulnerability can also trigger a hang or repeated crash, affecting availability. Successful exploitation leads to integrity and availability violations for all data exposed by the application.

Affected Systems

Oracle’s Siebel Apps – Marketing product, versions 17.0 through 26.6, is affected. The product runs as a web application and exposes HTTP endpoints that any user with network access can reach. All builds within the stated version range contain the flaw regardless of configuration.

Risk and Exploitability

The CVSS v3.1 base score of 8.1 indicates severe risk to integrity and availability. The EPSS score is less than 1 %, suggesting a low probability of exploitation in the field, yet the vulnerability is present in all versions and has no CISA KEV listing. The defect is remotely exploitable via HTTP, removing the need for user interaction. Overall, it presents a high‑severity issue that should be mitigated promptly.

Generated by OpenCVE AI on August 21, 2026 at 15:36 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle patch that addresses this vulnerability
  • Restrict HTTP access to the Siebel Apps Marketing server using firewalls or ACLs
  • Enforce least‑privilege role‑based access control and audit access logs regularly

Generated by OpenCVE AI on August 21, 2026 at 15:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 21 Aug 2026 16:00:00 +0000

Type Values Removed Values Added
Title Siebel Apps - Marketing HTTP Privilege Escalation and Denial of Service

Wed, 19 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Apps - Marketing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel Apps - Marketing accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel Apps - Marketing. CVSS 3.1 Base Score 8.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).
First Time appeared Oracle
Oracle siebel Apps - Marketing
CPEs cpe:2.3:a:oracle:siebel_apps_-_marketing:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle siebel Apps - Marketing
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H'}

Subscriptions

Oracle Siebel Apps - Marketing
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-19T19:14:56.520Z

Reserved: 2026-07-08T15:51:55.590Z

Link: CVE-2026-60779

cve-icon Vulnrichment

Updated: 2026-08-19T19:14:48.251Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:16:43.000

Modified: 2026-08-26T15:16:58.030

Link: CVE-2026-60779

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T15:45:18Z

Weaknesses