Description
Vulnerability in the Siebel CRM Administration product of Oracle Siebel CRM (component: Data Archival). Supported versions that are affected are 25.12-26.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Administration. Successful attacks of this vulnerability can result in takeover of Siebel CRM Administration. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-08-18
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the Data Archival component of Oracle Siebel CRM Administration allows an attacker with network access via HTTP to gain full control of the administration interface without authentication. The vulnerability is described as easily exploitable and can lead to a complete takeover, compromising confidentiality, integrity, and availability of the system.

Affected Systems

Oracle Siebel CRM Administration, versions 25.12 through 26.6, is affected by this vulnerability. The issue resides in the Data Archival component of these releases.

Risk and Exploitability

The CVSS v3.1 base score of 9.8 categorizes this as a critical vulnerability. The EPSS score of less than 1% indicates a very low but non-zero exploitation probability, and it is not listed in the CISA KEV catalog. The likely attack vector is over network-based HTTP, requiring no authentication; an attacker can send crafted requests to exploit the flaw and achieve total administrative takeover.

Generated by OpenCVE AI on August 21, 2026 at 11:29 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle official security patch for Siebel CRM Administration version 25.12‑26.6 or upgrade to a later release.
  • Restrict direct HTTP access to the Siebel CRM Administration interface, for example by placing the service behind a VPN or firewall that requires authentication.
  • Continuously monitor Siebel CRM Administration logs for unusual privilege‑elevating or suspicious HTTP requests.

Generated by OpenCVE AI on August 21, 2026 at 11:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 21 Aug 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Oracle siebel Crm
CPEs cpe:2.3:a:oracle:siebel_crm:*:*:*:*:*:*:*:*
Vendors & Products Oracle siebel Crm

Fri, 21 Aug 2026 11:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Code Execution via Data Archival in Siebel CRM Administration

Fri, 21 Aug 2026 09:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Code Execution in Oracle Siebel CRM Administration Via Data Archival
Weaknesses CWE-287

Fri, 21 Aug 2026 05:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 01:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Code Execution in Oracle Siebel CRM Administration Via Data Archival
Weaknesses CWE-284
CWE-287

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Siebel CRM Administration product of Oracle Siebel CRM (component: Data Archival). Supported versions that are affected are 25.12-26.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Administration. Successful attacks of this vulnerability can result in takeover of Siebel CRM Administration. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle siebel Crm Administration
CPEs cpe:2.3:a:oracle:siebel_crm_administration:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle siebel Crm Administration
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Siebel Crm Siebel Crm Administration
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-21T03:56:14.433Z

Reserved: 2026-07-14T14:54:48.743Z

Link: CVE-2026-62585

cve-icon Vulnrichment

Updated: 2026-08-20T16:46:35.323Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:17:10.653

Modified: 2026-08-21T14:56:05.090

Link: CVE-2026-62585

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T21:17:12Z

Weaknesses