CVE-2026-70855

Awaiting Analysis Awaiting Analysis - Queue

Cross-Site Scripting in Siebel Apps - Self Service

Publication date: 2026-08-18

Last updated on: 2026-08-26

Assigner: Oracle

Description

Vulnerability in the Siebel Apps - Self Service product of Oracle Siebel CRM (component: Helpdesk/Training). Supported versions that are affected are 17.0-26.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Self Service. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel Apps - Self Service, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel Apps - Self Service accessible data as well as unauthorized access to critical data or complete access to all Siebel Apps - Self Service accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-26

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-70855

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	siebel_crm	From 17.0 (inc) to 26.6 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability affects Oracle Siebel CRM's Self Service product, specifically versions 17.0 to 26.6. It allows an unauthenticated attacker to exploit the Helpdesk/Training component via HTTP network access. The attack requires human interaction from a victim and can lead to unauthorized data creation, deletion, or modification, as well as unauthorized access to critical data.

Detection Guidance

This vulnerability cannot be directly detected with specific commands as it requires manual verification of Oracle Siebel Apps - Self Service configurations and network traffic analysis. Check for exposed HTTP endpoints related to Helpdesk/Training components and ensure they are not accessible without authentication. Monitor for unusual data modification or creation requests in logs.

Impact Analysis

An attacker could gain unauthorized access to sensitive data, modify or delete critical information, or create false data within the Siebel Apps - Self Service system. This could disrupt operations, lead to data breaches, or compromise the integrity of stored information.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of personal or sensitive data, violating GDPR and HIPAA requirements for data confidentiality and integrity. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update for Siebel Apps - Self Service versions 17.0-26.6. Restrict network access to HTTP ports used by the vulnerable component. Monitor for unauthorized data modifications or access attempts.

Hi! I’m here to help you understand CVE-2026-70855. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70