CVE-2026-61332

Analyzed Analyzed - Analysis Complete

Privilege Escalation in Siebel CRM Cloud Applications

Publication date: 2026-08-18

Last updated on: 2026-09-01

Assigner: Oracle

Description

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.6. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM Cloud Applications accessible data as well as unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-09-01

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-06

NVD

CVE-2026-61332

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	siebel_crm	From 22.3 (inc) to 26.6 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Siebel CRM Cloud Applications (versions 22.3-26.6) where a high-privileged attacker with network access via HTTP can exploit it to compromise the system. Successful exploitation may allow unauthorized creation, deletion, or modification of critical data, or unauthorized access to all accessible data in Siebel CRM Cloud Applications.

Detection Guidance

Detection of this vulnerability requires monitoring for unauthorized access or modifications to Siebel CRM Cloud Applications. Check Oracle's official security advisories and apply patches. Review logs for unusual HTTP requests targeting the Siebel Cloud Manager component. Ensure network traffic to the affected component is restricted to authorized sources only.

Impact Analysis

If exploited, this vulnerability could lead to unauthorized access or manipulation of sensitive data within Siebel CRM Cloud Applications. Attackers might gain control over critical data, potentially causing data breaches, loss of integrity, or unauthorized modifications to business-critical information.

Compliance Impact

This vulnerability allows unauthorized access to critical data or complete access to all accessible data in Siebel CRM Cloud Applications. Such unauthorized access could lead to violations of data protection requirements under GDPR (e.g., unauthorized data access or modification) and HIPAA (e.g., unauthorized disclosure of protected health information).

Mitigation Strategies

Apply the latest security patches from Oracle for Siebel CRM Cloud Applications versions 22.3-26.6. Restrict network access to HTTP ports used by Siebel CRM Cloud Applications. Monitor for unauthorized data modifications or access attempts. Review user privileges to ensure least privilege access for high-privileged accounts.

Hi! I’m here to help you understand CVE-2026-61332. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70