Description
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Siebel CRM Cloud Applications. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Published: 2026-08-18
Score: 9.9 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Oracle Siebel CRM Cloud Applications is vulnerable to an easily exploitable flaw in the Siebel Cloud Manager component that permits a low‑privileged attacker with network access over HTTP to compromise the application. Successful exploitation can lead to full takeover of the system, affecting confidentiality, integrity and availability.

Affected Systems

Oracle Siebel CRM Cloud Applications, versions 22.3 through 26.6 are affected.

Risk and Exploitability

The Base CVSS score of 9.9 indicates a critical severity. The attack vector is network‑based, requires low privilege, and the vulnerability can change scope, suggesting a privilege escalation path. The EPSS score is <1%, indicating a very low exploitation probability. Despite the low EPSS, the confirmed high CVSS score and the ability to fully compromise the system warrant immediate attention. The vulnerability is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on August 21, 2026 at 12:47 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest vendor patch for Oracle Siebel CRM Cloud Applications that addresses the cloud manager flaw.
  • Restrict HTTP access to the Siebel environment to trusted networks or IP ranges.
  • Enforce least‑privilege access controls for all user accounts interacting with the application.

Generated by OpenCVE AI on August 21, 2026 at 12:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 02 Sep 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Oracle siebel Crm
CPEs cpe:2.3:a:oracle:siebel_crm:*:*:*:*:*:*:*:*
Vendors & Products Oracle siebel Crm

Fri, 21 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
Title Low-Privilege HTTP Exploit Enables Full Application Takeover in Oracle Siebel CRM Cloud Manager

Fri, 21 Aug 2026 11:45:00 +0000

Type Values Removed Values Added
Title Remote takeover of Oracle Siebel CRM Cloud Applications via low‑privilege HTTP exploitation
Weaknesses CWE-77

Wed, 19 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 01:15:00 +0000

Type Values Removed Values Added
Title Remote takeover of Oracle Siebel CRM Cloud Applications via low‑privilege HTTP exploitation
Weaknesses CWE-284
CWE-77

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Siebel CRM Cloud Applications. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
First Time appeared Oracle
Oracle siebel Crm Cloud Applications
CPEs cpe:2.3:a:oracle:siebel_crm_cloud_applications:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle siebel Crm Cloud Applications
References
Metrics cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Oracle Siebel Crm Siebel Crm Cloud Applications
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-20T03:56:53.197Z

Reserved: 2026-07-08T15:52:20.747Z

Link: CVE-2026-61317

cve-icon Vulnrichment

Updated: 2026-08-19T19:49:31.836Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:16:59.737

Modified: 2026-09-02T17:35:28.727

Link: CVE-2026-61317

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T13:15:05Z

Weaknesses