CVE-2026-60690: Siebel CRM Auth Bypass Vulnerability

CVE-2026-60690 Overview

CVE-2026-60690 affects the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications. Supported versions 22.3 through 26.5 are affected. A low-privileged attacker with network access via HTTP can exploit this flaw to compromise Siebel CRM Cloud Applications. Successful exploitation grants unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data. The vulnerability produces a scope change, meaning attacks may significantly impact additional products beyond the vulnerable component. Oracle addressed the issue in the Oracle Critical Patch Update July 2026.

Critical Impact
Authenticated attackers with low privileges can gain unauthorized access to all data accessible through Siebel CRM Cloud Applications, with impact extending beyond the vulnerable component due to a scope change.

Affected Products

Oracle Siebel CRM Cloud Applications 22.3 through 26.5
Siebel Cloud Manager component
Deployments using HTTP-accessible Siebel Cloud Manager interfaces

Discovery Timeline

2026-07-21 - CVE-2026-60690 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle releases fix in the Critical Patch Update July 2026

Technical Details for CVE-2026-60690

Vulnerability Analysis

The vulnerability resides in the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications. Oracle categorizes exploitation as easily achievable over HTTP with low privileges required and no user interaction. The confidentiality impact is high, while integrity and availability are not affected. The scope change classification indicates the vulnerable component can affect resources beyond its own security authority. Attackers who obtain any low-privileged account on the platform can pivot to read data from other tenants, services, or products connected to the Siebel Cloud Manager. The EPSS score is 0.371% as of the July 2026 assessment.

Root Cause

Oracle has not publicly disclosed the specific coding defect. The behavior — cross-scope confidentiality loss reachable by an authenticated HTTP client — is consistent with broken access control or authorization checks in the Siebel Cloud Manager request handlers. The component appears to trust caller-supplied context when returning data that should be filtered by tenant, role, or scope.

Attack Vector

Exploitation is remote and network-based over HTTP. The attacker requires a valid low-privileged account against the Siebel Cloud Manager endpoint. No user interaction and no elevated privileges are required. Because the flaw triggers a scope change, a request accepted by Siebel Cloud Manager can cause disclosure of data owned by other products or components integrated with the platform. Public proof-of-concept code is not currently available.

See the Oracle Critical Patch Update July 2026 advisory for vendor-provided technical details.

Detection Methods for CVE-2026-60690

Indicators of Compromise

Authenticated HTTP requests to Siebel Cloud Manager endpoints from low-privileged accounts that return data outside the account's expected tenant or scope.
Unusual volume of successful 200 OK responses to Cloud Manager APIs from a single session or IP.
Access to Siebel resources without corresponding front-end user interaction in Siebel CRM audit logs.

Detection Strategies

Correlate Siebel Cloud Manager access logs with role and tenant metadata to flag responses that return records outside the authenticated principal's authorized scope.
Baseline per-account API request rates against Siebel Cloud Manager and alert on deviation.
Inspect HTTP request patterns for identifier enumeration against Siebel Cloud Manager endpoints.

Monitoring Recommendations

Forward Siebel CRM and Cloud Manager application logs to a centralized SIEM or data lake for cross-account correlation.
Enable Oracle Siebel auditing on privileged read operations and retain logs for post-patch review.
Monitor authentication events for low-privileged accounts newly interacting with Cloud Manager administrative paths.

How to Mitigate CVE-2026-60690

Immediate Actions Required

Apply the fixes shipped in the Oracle Critical Patch Update July 2026 to all Siebel CRM Cloud Applications instances running versions 22.3 through 26.5.
Inventory every Siebel Cloud Manager deployment and confirm patch level after remediation.
Rotate credentials and API tokens for low-privileged Siebel accounts that were reachable prior to patching.
Review Siebel Cloud Manager access logs for signs of unauthorized cross-scope data reads.

Patch Information

Oracle released fixes for CVE-2026-60690 in the Critical Patch Update July 2026. Administrators must upgrade affected Siebel CRM Cloud Applications instances to a patched release covering versions 22.3 through 26.5. Consult the Oracle Critical Patch Update July 2026 advisory for the specific patch identifiers applicable to each supported version.

Workarounds

Restrict network access to Siebel Cloud Manager HTTP endpoints to trusted management networks until patching is complete.
Enforce least privilege on Siebel accounts and remove unused low-privileged accounts that could be leveraged for authenticated access.
Place a reverse proxy or web application firewall in front of Siebel Cloud Manager to log and rate-limit API traffic pending remediation.

bash

# Configuration example: restrict Siebel Cloud Manager exposure at the network edge
# Replace SIEBEL_MGMT_CIDR and CLOUD_MGR_HOST with values for your environment
iptables -A INPUT -p tcp --dport 443 -s SIEBEL_MGMT_CIDR -d CLOUD_MGR_HOST -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -d CLOUD_MGR_HOST -j DROP