CVE-2026-61318

Analyzed Analyzed - Analysis Complete

Authentication Bypass in Siebel CRM Cloud Applications

Publication date: 2026-08-18

Last updated on: 2026-09-02

Assigner: Oracle

Description

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in takeover of Siebel CRM Cloud Applications. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-09-02

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-06

NVD

CVE-2026-61318

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	siebel_crm	From 22.3 (inc) to 26.6 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a critical vulnerability in Oracle Siebel CRM Cloud Applications affecting versions 22.3 to 26.6. It allows an unauthenticated attacker to remotely compromise the system via HTTP network access, potentially leading to full takeover of the application. The vulnerability has a CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.

Detection Guidance

This vulnerability affects Oracle Siebel CRM Cloud Applications versions 22.3-26.6 and allows unauthenticated network access via HTTP. Detection should focus on identifying exposed instances of Siebel CRM Cloud Applications and verifying patch levels. Check for open HTTP ports (typically 80 or 443) and inspect server headers for Siebel components. Review access logs for unusual unauthenticated requests to administrative endpoints.

Impact Analysis

If you use Oracle Siebel CRM Cloud Applications in the affected versions, an attacker could gain complete control over your system. This could lead to unauthorized access to sensitive data, modification or deletion of critical information, and disruption of services, causing significant operational and reputational damage.

Compliance Impact

This vulnerability could severely impact compliance with GDPR and HIPAA by enabling unauthorized access to personal or health data. A successful exploit may result in data breaches, leading to legal penalties, loss of customer trust, and failure to meet regulatory requirements for data protection and security.

Mitigation Strategies

Apply the latest Oracle Siebel CRM Cloud Applications patches immediately as they become available. Ensure network access to the Siebel Cloud Manager component is restricted and monitored. Review and update firewall rules to limit HTTP access to trusted sources only.

Hi! I’m here to help you understand CVE-2026-61318. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70