CVE-2026-60757

Analyzed Analyzed - Analysis Complete

Siebel CRM End User Search Component Access Control Flaw

Publication date: 2026-08-18

Last updated on: 2026-08-26

Assigner: Oracle

Description

Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Search). Supported versions that are affected are 17.0-26.6. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Siebel CRM End User executes to compromise Siebel CRM End User. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM End User accessible data as well as unauthorized access to critical data or complete access to all Siebel CRM End User accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-26

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-06

NVD

CVE-2026-60757

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	siebel_crm	From 17.0 (inc) to 26.6 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability affects Oracle Siebel CRM End User versions 17.0 to 26.6. It allows an unauthenticated attacker with access to the physical network segment where Siebel CRM runs to exploit a flaw in the Search component. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, as well as unauthorized access to all accessible data in the system.

Detection Guidance

Detection requires monitoring network traffic for unauthorized access attempts to the Siebel CRM End User component, particularly on the physical communication segment. Check for unusual data modification or creation requests targeting critical data. Ensure Siebel CRM logs are reviewed for anomalies in search operations or unauthorized access patterns.

Impact Analysis

If you use Oracle Siebel CRM End User versions 17.0 to 26.6, an attacker on the same physical network could gain full access to your critical data. This includes reading, modifying, or deleting sensitive information, potentially leading to data breaches, financial loss, or operational disruption.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using affected versions may face legal penalties, reputational damage, and loss of customer trust due to potential data breaches.

Mitigation Strategies

Apply the latest Oracle Siebel CRM End User patch or update to version 26.7 or later as this vulnerability affects versions 17.0-26.6. Ensure the system is isolated from untrusted networks and restrict physical access to the hardware where Siebel CRM End User executes.

Hi! I’m here to help you understand CVE-2026-60757. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70