CVE-2026-60752: Oracle Siebel CRM Auth Bypass Vulnerability

CVE-2026-60752 Overview

CVE-2026-60752 is an improper access control vulnerability [CWE-284] in the Marketing component of Oracle Siebel CRM's Siebel Apps - Marketing product. The flaw affects supported versions 17.0 through 26.6. A low-privileged attacker with network access via HTTP can exploit the weakness without user interaction. Successful exploitation grants unauthorized access to all Siebel Apps - Marketing accessible data and enables a partial denial of service condition against the application.

Critical Impact
Authenticated attackers can retrieve confidential marketing data across the application and degrade service availability over standard HTTP channels.

Affected Products

Oracle Siebel CRM - Siebel Apps - Marketing versions 17.0 through 26.6
Marketing component of Oracle Siebel CRM
Deployments exposing the Siebel Apps - Marketing interface over HTTP

Discovery Timeline

2026-08-18 - CVE-2026-60752 published to the National Vulnerability Database
2026-08-20 - CVE-2026-60752 record last modified in NVD
August 2026 - Oracle publishes Critical Patch Update advisory cspuaug2026

Technical Details for CVE-2026-60752

Vulnerability Analysis

The vulnerability resides in the Marketing component of Oracle Siebel CRM's Siebel Apps - Marketing product. It is classified under [CWE-284: Improper Access Control], indicating the application fails to enforce authorization boundaries correctly on requests reaching the Marketing subsystem.

The scope of the flaw is significant. Oracle's advisory states that successful attacks can result in unauthorized access to critical data or complete access to all Siebel Apps - Marketing accessible data. Attackers can also trigger a partial denial of service against the Marketing application.

Exploitation requires only low privileges and no user interaction. An attacker with any authenticated foothold in the Siebel environment can reach the vulnerable functionality over the network via HTTP.

Root Cause

The root cause is improper access control within the Marketing module. Authorization checks are either missing or improperly enforced for requests that read or manipulate Marketing data. As a result, a user account with limited entitlements can invoke operations reserved for higher-privileged roles and access data outside its intended scope.

Attack Vector

The attack vector is network-based over HTTP. An authenticated attacker sends crafted requests to the Marketing component using existing valid credentials. Because the vulnerability is easily exploitable and does not require user interaction, insider threats and attackers who have obtained low-privileged credentials through phishing or credential reuse pose the primary risk.

No public proof-of-concept code has been released, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Oracle Security Alert for authoritative technical details.

Detection Methods for CVE-2026-60752

Indicators of Compromise

Unexpected HTTP requests from low-privileged Siebel accounts targeting Marketing component endpoints or URLs
Anomalous volumes of Marketing data reads or exports from a single user session
Application errors or transient service degradation in the Siebel Apps - Marketing tier consistent with partial denial of service
Access to Marketing records outside a user's assigned territory, campaign, or organizational scope

Detection Strategies

Enable Siebel audit trail on Marketing business components and review access records for accounts operating outside their normal role scope
Correlate web server access logs with Siebel session identifiers to identify authenticated users invoking Marketing endpoints they have never used before
Monitor authorization denial events followed by successful requests to the same resource, which can indicate access control bypass attempts

Monitoring Recommendations

Alert on spikes in HTTP 4xx followed by 2xx responses against Marketing component URIs from the same session
Track unusually large result sets returned to non-administrative Siebel users
Baseline normal Marketing API usage per role and alert on statistical deviations

How to Mitigate CVE-2026-60752

Immediate Actions Required

Apply the fixes distributed in the Oracle August 2026 Critical Patch Update referenced in the Oracle Security Alert
Inventory all Siebel CRM deployments and confirm which run affected versions 17.0 through 26.6
Rotate credentials for low-privileged Siebel accounts that have not been validated recently, since exploitation requires only authenticated access
Restrict network reachability of the Siebel Apps - Marketing HTTP endpoints to trusted networks and VPN users only

Patch Information

Oracle addresses CVE-2026-60752 in the August 2026 Critical Patch Update. Administrators must review the Oracle Security Alert for the specific patch identifiers that apply to their Siebel CRM version and platform. Apply patches in a non-production environment first and validate Marketing workflows before rolling forward to production.

Workarounds

Tighten Siebel responsibility and position assignments so low-privileged users cannot reach Marketing views or business components
Place a web application firewall in front of the Siebel web tier and restrict access to Marketing URIs to authorized user groups
Enforce multi-factor authentication on all Siebel accounts to raise the cost of obtaining low-privileged credentials
Increase audit logging on the Marketing component until patches are deployed

bash

# Configuration example: restrict Marketing endpoints at the reverse proxy
# Apache httpd example - allow only trusted subnet to reach Marketing URIs
<Location "/siebel/app/callcenter/enu/Marketing">
    Require ip 10.10.0.0/16
    Require valid-user
</Location>