Description
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in takeover of Siebel CRM Cloud Applications. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-08-18
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is located in the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications. It allows an attacker who has network connectivity to the application over HTTP to authenticate implicitly and gain full control of the system. Because no user credentials are required, the flaw enables a remote takeover that can leak confidential information, alter data, and disrupt services. The weakness maps to improper access control.

Affected Systems

The affected product is Oracle Siebel CRM Cloud Applications, versions 22.3 through 26.6 inclusive. These releases are widely used by enterprises for customer relationship management.

Risk and Exploitability

The CVSS v3.1 base score is 9.8, indicating critical severity. The exploit does not require authentication or user interaction, uses the network attack vector, and delivers complete compromise of confidentiality, integrity, and availability. The EPSS score is < 1%, so the probability of exploitation is low but nonzero, and the vulnerability is not listed in CISA’s KEV catalog. The flaw can be executed by any unauthenticated actor with HTTP access to the Siebel CRM Cloud Applications endpoint.

Generated by OpenCVE AI on August 21, 2026 at 11:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch for Siebel CRM Cloud Applications, released in August 2026, which addresses the component vulnerability.
  • Restrict network reachability to the Siebel CRM HTTP endpoint using firewall rules or VPN‑only access so that only trusted internal hosts can connect.
  • Enable detailed logging and real‑time monitoring for unusual HTTP requests to the Siebel CRM endpoint and set up alerts for repeated failed or unexpected connections.
  • If a patch cannot be applied immediately, consider disabling the exposed HTTP service or placing the application behind an internal reverse proxy that requires authentication.

Generated by OpenCVE AI on August 21, 2026 at 11:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 02 Sep 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Oracle siebel Crm
CPEs cpe:2.3:a:oracle:siebel_crm:*:*:*:*:*:*:*:*
Vendors & Products Oracle siebel Crm

Fri, 21 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Code Execution in Oracle Siebel CRM Cloud Manager via HTTP

Wed, 19 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 01:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Code Execution in Oracle Siebel CRM Cloud Manager via HTTP
Weaknesses CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in takeover of Siebel CRM Cloud Applications. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle siebel Crm Cloud Applications
CPEs cpe:2.3:a:oracle:siebel_crm_cloud_applications:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle siebel Crm Cloud Applications
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Siebel Crm Siebel Crm Cloud Applications
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-20T03:56:50.983Z

Reserved: 2026-07-08T15:52:20.747Z

Link: CVE-2026-61318

cve-icon Vulnrichment

Updated: 2026-08-19T19:32:14.304Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:16:59.847

Modified: 2026-09-02T17:32:04.633

Link: CVE-2026-61318

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T12:00:11Z

Weaknesses