Description
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications. While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data as well as unauthorized update, insert or delete access to some of Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 7.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).
Published: 2026-08-18
Score: 7.3 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A low‑privileged attacker who can log on to the infrastructure hosting Oracle Siebel CRM Cloud Applications can exploit a flaw in the Siebel Cloud Manager component, an Improper Access Control (CWE‑284) vulnerability, allowing compromise of the application. Successful exploitation can lead to unauthorized reading of sensitive data and modification—adding, deleting, or updating data—within the application’s accessible dataset. The vulnerability’s effect reaches beyond the application, potentially affecting other integrated products.

Affected Systems

Oracle Siebel CRM Cloud Applications, affected versions 22.3 through 26.6.

Risk and Exploitability

The CVSS 3.1 base score of 7.3 indicates a high confidentiality impact with low integrity impact. The vector shows an attacker with low privileges on the hosting infrastructure (AV:L), low attack complexity (AC:L), and no user interaction (UI:N) can achieve this gain. With the scope change (S:C), the vulnerability can extend beyond the application boundaries. The EPSS score of 0.00116 indicates a very low exploitation probability. The vulnerability is not listed in CISA KEV, but the high impact combined with the ease of exploitation warrants attention.

Generated by OpenCVE AI on August 21, 2026 at 13:00 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle patch that addresses the CWE-284 Improper Access Control flaw for affected versions 22.3‑26.6.
  • Ensure that only trusted administrators have OS‑level logon rights; remove or restrict low‑privileged user accounts from the infrastructure hosting the application.
  • Implement network segmentation and enforce strict access controls to isolate Siebel servers and limit exposure to the application’s interfaces.

Generated by OpenCVE AI on August 21, 2026 at 13:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 01 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
First Time appeared Oracle siebel Crm
CPEs cpe:2.3:a:oracle:siebel_crm:*:*:*:*:*:*:*:*
Vendors & Products Oracle siebel Crm

Fri, 21 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
Title Low-Privilege Access Allows Unauthorized Data Read and Modification in Oracle Siebel CRM Cloud Applications

Fri, 21 Aug 2026 11:45:00 +0000

Type Values Removed Values Added
Title Low‑Privilege Logon Exploitation Allowing Unauthorized Data Access in Siebel CRM Cloud Applications
Weaknesses CWE-285

Fri, 21 Aug 2026 05:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 01:00:00 +0000

Type Values Removed Values Added
Title Low‑Privilege Logon Exploitation Allowing Unauthorized Data Access in Siebel CRM Cloud Applications
Weaknesses CWE-284
CWE-285

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications. While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data as well as unauthorized update, insert or delete access to some of Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 7.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).
First Time appeared Oracle
Oracle siebel Crm Cloud Applications
CPEs cpe:2.3:a:oracle:siebel_crm_cloud_applications:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle siebel Crm Cloud Applications
References
Metrics cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N'}

Subscriptions

Oracle Siebel Crm Siebel Crm Cloud Applications
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-21T03:56:11.122Z

Reserved: 2026-07-08T15:52:20.748Z

Link: CVE-2026-61339

cve-icon Vulnrichment

Updated: 2026-08-20T16:46:32.258Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:17:00.673

Modified: 2026-09-01T19:55:44.673

Link: CVE-2026-61339

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T13:15:05Z

Weaknesses