CVE-2026-62594

Analyzed Analyzed - Analysis Complete

Siebel CRM Integration Privilege Escalation Vulnerability

Publication date: 2026-08-18

Last updated on: 2026-08-21

Assigner: Oracle

Description

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration). Supported versions that are affected are 25.12-26.6. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Siebel CRM Integration. While the vulnerability is in Siebel CRM Integration, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM Integration accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel CRM Integration. CVSS 3.1 Base Score 7.7 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-21

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-06

NVD

CVE-2026-62594

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	siebel_crm	From 25.12 (inc) to 26.6 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Siebel CRM's Siebel CRM Integration product, specifically in the Open Integration component. It affects versions 25.12 through 26.6. The issue allows a highly privileged attacker with network access via HTTP to compromise the system. While the vulnerability is in Siebel CRM Integration, attacks may impact other products as well.

Detection Guidance

This vulnerability is specific to Oracle Siebel CRM Integration and requires high-privileged network access via HTTP. Detection would involve monitoring HTTP traffic to Siebel CRM Integration endpoints, checking for unusual data modification or deletion requests, or identifying repeated crashes of the integration service. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to gain unauthorized access to create, delete, or modify critical data within Siebel CRM Integration. They could also cause the system to crash repeatedly or hang, leading to a denial of service (DOS). This requires high privileges and network access but could severely disrupt operations.

Compliance Impact

This vulnerability could lead to unauthorized data modification or deletion, violating integrity requirements in GDPR and HIPAA. A DOS condition could disrupt access to critical data, potentially breaching availability requirements. Organizations may face compliance violations if exploited.

Mitigation Strategies

Apply the latest security patches from Oracle for Siebel CRM Integration versions 25.12-26.6. Restrict network access to HTTP interfaces and limit privileges for users accessing the system. Monitor for unusual activity or crashes in Siebel CRM Integration.

Hi! I’m here to help you understand CVE-2026-62594. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70