CVE-2026-60713: Siebel CRM Auth Bypass Vulnerability

CVE-2026-60713 Overview

CVE-2026-60713 affects the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications. The flaw exists in supported versions 22.3 through 26.5. A low-privileged attacker with logon access to the infrastructure running Siebel CRM Cloud Applications can exploit this weakness. Successful exploitation permits unauthorized update, insert, or delete operations against a subset of accessible data. The attacker can also achieve unauthorized read access to a subset of the same data. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
Authenticated local attackers can modify and read a subset of Siebel CRM Cloud Applications data, undermining confidentiality and integrity of business records.

Affected Products

Oracle Siebel CRM Cloud Applications version 22.3
Oracle Siebel CRM Cloud Applications versions 23.x through 25.x
Oracle Siebel CRM Cloud Applications version 26.5 (Siebel Cloud Manager component)

Discovery Timeline

2026-07-21 - CVE-2026-60713 published to NVD as part of Oracle's July 2026 Critical Patch Update
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-60713

Vulnerability Analysis

The vulnerability resides in the Siebel Cloud Manager component, which orchestrates cloud-hosted Siebel CRM operations. Oracle classifies the issue as easily exploitable, requiring only local logon access and low privileges. The attacker acts within the infrastructure where Siebel CRM Cloud Applications executes, meaning remote network reach is not required. Exploitation yields partial confidentiality loss through unauthorized read access to a subset of data. It also produces partial integrity loss through unauthorized insert, update, or delete operations. Availability of the service is not impacted according to Oracle's advisory. The scope of impact is limited to data managed by the vulnerable component itself.

Root Cause

Oracle has not published the underlying weakness class or CWE identifier for CVE-2026-60713. The advisory indicates the defect allows an authenticated local principal to perform actions beyond their assigned authorization boundary. This pattern is consistent with a broken access control or improper authorization condition within the Siebel Cloud Manager privilege model.

Attack Vector

The attack requires local access to the Siebel CRM Cloud Applications infrastructure and a valid low-privileged account. No user interaction is needed and attack complexity is low. Once authenticated, the attacker interacts with Siebel Cloud Manager interfaces to reach data or operations outside their privilege tier. Oracle has not released public proof-of-concept code, and no exploit is currently available. The EPSS probability is 0.14%, reflecting a low near-term likelihood of observed exploitation.

See the Oracle Critical Patch Update - July 2026 for vendor technical details.

Detection Methods for CVE-2026-60713

Indicators of Compromise

Unexpected insert, update, or delete operations in Siebel CRM audit tables originating from low-privileged accounts
Access to Siebel Cloud Manager administrative functions by users outside the designated administrator role
Anomalous read queries returning records the authenticated principal is not authorized to view

Detection Strategies

Enable Siebel audit trail on sensitive business objects and forward records to a centralized log platform
Baseline normal Siebel Cloud Manager activity per role, then alert on deviations such as privilege-tier boundary crossings
Correlate operating system logon events on Siebel infrastructure with application-level actions to identify local misuse

Monitoring Recommendations

Ingest Siebel application, database, and OS logs into a SIEM with role-based query analytics
Monitor for repeated failed authorization checks that precede successful anomalous operations
Review privileged account inventories on Siebel hosts and validate least-privilege enforcement

How to Mitigate CVE-2026-60713

Immediate Actions Required

Apply the Oracle July 2026 Critical Patch Update to all Siebel CRM Cloud Applications instances running versions 22.3 through 26.5
Inventory local accounts on Siebel infrastructure hosts and remove unnecessary logon rights
Restrict network access to Siebel Cloud Manager management interfaces to authorized administrators only

Patch Information

Oracle released the fix in the July 2026 Critical Patch Update. Administrators should follow the CPU advisory for patch identifiers specific to their deployed Siebel version. Test the update in a non-production environment before rolling out to production tenants.

Workarounds

Limit interactive and service account logons on Siebel CRM Cloud Applications infrastructure to a minimum verified set
Enforce multi-factor authentication for any account with logon access to Siebel hosts
Increase Siebel audit granularity on business objects that the Cloud Manager component can reach until patching is complete

bash

# Configuration example: verify installed Siebel patch level after CPU application
cd $SIEBEL_ROOT/bin
./siebenv.sh
srvrmgr /g <gateway> /e <enterprise> /u SADMIN /p <pwd> \
  -c "list patch info"