Description
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Document Management). Supported versions that are affected are 17.0-26.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks of this vulnerability can result in takeover of Siebel CRM End User. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-08-18
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw resides in the Document Management component of Oracle Siebel CRM End User, where weak access control allows a low‑privileged attacker with network access via HTTP to execute actions that compromise confidentiality, integrity and availability of the whole application, effectively giving an attacker complete control over the system.

Affected Systems

Oracle Siebel CRM End User versions 17.0 through 26.6 are affected; the vulnerability targets only the Document Management component and does not impact other Oracle product lines.

Risk and Exploitability

The vulnerability carries a CVSS 3.1 base score of 8.8, indicating high severity, and can be exploited remotely over HTTP by a user with low privileges and no user interaction. The EPSS score is less than 1%, suggesting a low but non‑zero likelihood of exploitation in the wild, and the flaw is not listed in CISA KEV. Without an official fix, the risk remains significant, urging immediate implementation of mitigations.

Generated by OpenCVE AI on August 21, 2026 at 04:34 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Restrict HTTP access to the Siebel CRM End User instance to trusted networks or enforce a VPN tunnel.
  • Enforce stronger authentication for low‑privileged accounts, such as multi‑factor authentication and least privilege restrictive rules.
  • Monitor and log all Document Management operations for anomalous activity, and consider disabling the feature if it is not required.

Generated by OpenCVE AI on August 21, 2026 at 04:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 02 Sep 2026 14:00:00 +0000

Type Values Removed Values Added
First Time appeared Oracle siebel Crm
CPEs cpe:2.3:a:oracle:siebel_crm:*:*:*:*:*:*:*:*
Vendors & Products Oracle siebel Crm

Fri, 21 Aug 2026 05:00:00 +0000

Type Values Removed Values Added
Title Low‑Privilege Remote Exploit of Oracle Siebel CRM Document Management Enables Full Application Takeover

Thu, 20 Aug 2026 10:00:00 +0000

Type Values Removed Values Added
Title Remote Takeover via Document Management in Oracle Siebel CRM End User
Weaknesses CWE-287

Wed, 19 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 09:15:00 +0000

Type Values Removed Values Added
Title Remote Takeover via Document Management in Oracle Siebel CRM End User
Weaknesses CWE-287

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Document Management). Supported versions that are affected are 17.0-26.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks of this vulnerability can result in takeover of Siebel CRM End User. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle siebel Crm End User
CPEs cpe:2.3:a:oracle:siebel_crm_end_user:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle siebel Crm End User
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Siebel Crm Siebel Crm End User
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-20T03:56:39.872Z

Reserved: 2026-08-04T22:06:34.607Z

Link: CVE-2026-70951

cve-icon Vulnrichment

Updated: 2026-08-19T18:30:07.987Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:17:53.383

Modified: 2026-09-02T13:40:34.207

Link: CVE-2026-70951

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T04:45:03Z

Weaknesses