Description
Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration). Supported versions that are affected are 25.12-26.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration. Successful attacks of this vulnerability can result in takeover of Siebel CRM Integration. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-08-18
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in Oracle Siebel CRM Integration, specifically the Open Integration component, allows an attacker who can reach the service via HTTP to authenticate no credentials and execute arbitrary actions on the target system. The vulnerability can be leveraged to compromise the integrity and confidentiality of the CRM integration subsystem, potentially leading to full control of the service and access to sensitive customer data.

Affected Systems

Oracle Siebel CRM Integration versions 25.12 through 26.6 are known to be affected. The issue resides in the Open Integration component of the product.

Risk and Exploitability

The CVSS v3.1 base score of 9.8 indicates critical severity, with high impact on confidentiality, integrity, and availability. No EPSS score is currently available and the issue is not listed in the CISA KEV catalog. The likely attack vector is unauthenticated HTTP network access, with low attack complexity and no user interaction required, meaning the risk of exploitation is high for exposed services.

Generated by OpenCVE AI on August 21, 2026 at 09:05 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch or upgrade to a version newer than 26.6 to remove the vulnerability.
  • Configure network segmentation or a firewall to block unauthenticated HTTP traffic to the Siebel CRM Integration component, ensuring that only authorized traffic can reach the service.
  • Deploy monitoring on authentication and access logs for signs of unauthorized access attempts and verify that network restrictions are enforced.

Generated by OpenCVE AI on August 21, 2026 at 09:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 21 Aug 2026 09:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Exploit Compromises Siebel CRM Integration

Thu, 20 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Oracle siebel Crm
CPEs cpe:2.3:a:oracle:siebel_crm:*:*:*:*:*:*:*:*
Vendors & Products Oracle siebel Crm

Thu, 20 Aug 2026 05:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 01:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Exploit Compromises Siebel CRM Integration
Weaknesses CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration). Supported versions that are affected are 25.12-26.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration. Successful attacks of this vulnerability can result in takeover of Siebel CRM Integration. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle siebel Crm Integration
CPEs cpe:2.3:a:oracle:siebel_crm_integration:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle siebel Crm Integration
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Siebel Crm Siebel Crm Integration
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-20T03:56:17.734Z

Reserved: 2026-07-14T14:54:48.743Z

Link: CVE-2026-62592

cve-icon Vulnrichment

Updated: 2026-08-19T15:33:21.690Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:17:11.460

Modified: 2026-08-20T15:10:03.480

Link: CVE-2026-62592

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T09:15:05Z

Weaknesses