Description
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Siebel CRM Cloud Applications. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Published: 2026-08-18
Score: 9.9 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability exists in the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications. It enables a low‑privileged attacker who can reach the service over HTTP to fully compromise the application, resulting in loss of confidentiality, integrity, and availability. The weakness is an improper access control that permits exploitation without elevated permissions.

Affected Systems

Vendor: Oracle Corporation. Product: Siebel CRM Cloud Applications (Siebel Cloud Manager). Affected versions are 22.3 through 26.6, inclusive. No other version information is provided.

Risk and Exploitability

The CVSS 3.1 base score is 9.9, indicating critical risk. EPSS score is 0.00447, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers require network access over HTTP and only low privileges to exploit the flaw. Successful exploitation leads to takeover of the CRM instance and may affect connected products due to scope change.

Generated by OpenCVE AI on August 21, 2026 at 10:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle security patch or upgrade to a version newer than 26.6 as detailed in the Oracle security alert
  • Revoke or limit low‑privileged user roles that have access to the HTTP endpoints used by Siebel Cloud Manager
  • Configure network firewalls to restrict inbound HTTP traffic to the Siebel CRM Cloud Applications servers to trusted IP ranges
  • Enable logging and monitoring for abnormal authentication or API activity against the CRM service

Generated by OpenCVE AI on August 21, 2026 at 10:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 01 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
First Time appeared Oracle siebel Crm
CPEs cpe:2.3:a:oracle:siebel_crm:*:*:*:*:*:*:*:*
Vendors & Products Oracle siebel Crm

Fri, 21 Aug 2026 11:15:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via HTTP by Low-Privilege Users in Oracle Siebel CRM Cloud Applications

Fri, 21 Aug 2026 05:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Siebel CRM Cloud Applications. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
First Time appeared Oracle
Oracle siebel Crm Cloud Applications
CPEs cpe:2.3:a:oracle:siebel_crm_cloud_applications:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle siebel Crm Cloud Applications
References
Metrics cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Oracle Siebel Crm Siebel Crm Cloud Applications
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-21T03:56:10.006Z

Reserved: 2026-07-14T14:54:48.737Z

Link: CVE-2026-62512

cve-icon Vulnrichment

Updated: 2026-08-20T16:46:31.172Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:17:04.933

Modified: 2026-09-01T19:55:16.983

Link: CVE-2026-62512

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T11:00:05Z

Weaknesses