CVE-2026-60705: Infoleak
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data as well as unauthorized update, insert or delete access to some of Siebel CRM Cloud Applications accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Siebel CRM Cloud Applications. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L).
Affected Software
Event History
Frequently Asked Questions
Which deployments should be prioritized for review?
Prioritize Oracle Siebel CRM Cloud Applications deployments running supported versions 22.3 through 26.5 that include the Siebel Cloud Manager component and are reachable over HTTP from an attacker’s network location.
Does exploitation require an authenticated Siebel account or user interaction?
No. The vulnerability can be exploited by an unauthenticated attacker with network access via HTTP, and it does not require user interaction. Exploitation is described as difficult, indicating high attack complexity.
What could a successful attacker do?
A successful attack could expose critical data or all accessible Siebel CRM Cloud Applications data. It could also permit updates, inserts, or deletions to some accessible data and cause a partial denial of service.