CVE-2026-60754: Oracle Siebel CRM Auth Bypass Vulnerability

CVE-2026-60754 Overview

CVE-2026-60754 is an improper access control vulnerability [CWE-284] in the Siebel Apps - Marketing component of Oracle Siebel CRM. Affected versions span 17.0 through 26.6. An unauthenticated attacker with network access over HTTP can exploit the flaw without user interaction. Successful exploitation grants unauthorized access to all Siebel Apps - Marketing accessible data and can trigger a repeatable crash resulting in complete denial of service. Oracle disclosed the issue in the Oracle Security Alert dated August 2026.

Critical Impact
Remote, unauthenticated attackers can read sensitive marketing data and force a complete denial of service against Oracle Siebel CRM Marketing deployments.

Affected Products

Oracle Siebel CRM - Siebel Apps - Marketing version 17.0
Oracle Siebel CRM - Siebel Apps - Marketing versions 17.0 through 26.6
Oracle Siebel CRM - Marketing component (all supported releases in the affected range)

Discovery Timeline

2026-08-18 - CVE-2026-60754 published to the National Vulnerability Database
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-60754

Vulnerability Analysis

The vulnerability resides in the Marketing component of Oracle Siebel CRM Siebel Apps - Marketing. It is classified under [CWE-284] Improper Access Control. The flaw is reachable over the network via HTTP and requires neither authentication nor user interaction. An attacker who submits crafted HTTP requests to an exposed Siebel Marketing endpoint can read data across the entire scope of the Marketing application. The same request path can also be used to induce a hang or repeatable crash, producing a complete denial of service.

The EPSS score is 0.486% (percentile 39.992) as of 2026-08-20, indicating limited observed exploitation activity at publication time. No public proof-of-concept, exploit kit, or CISA KEV listing exists for this CVE at the time of writing.

Root Cause

The root cause is improper enforcement of access control checks on HTTP-accessible functionality inside the Marketing component. Requests that should require authentication and authorization are processed without adequate validation. This allows an anonymous caller to reach code paths that read protected data and manipulate application state in ways that destabilize the service.

Attack Vector

The attack vector is network-based over HTTP against an internet- or intranet-reachable Siebel Apps - Marketing instance. The attacker sends specially crafted HTTP requests to affected endpoints. No credentials, tokens, or prior foothold are required. Because the confidentiality impact is high and integrity impact is none, the vulnerability is best characterized as an unauthenticated data exposure and denial-of-service issue rather than a code-execution primitive.

No verified exploit code is publicly available. See the Oracle Security Alert August 2026 for the vendor's technical guidance.

Detection Methods for CVE-2026-60754

Indicators of Compromise

Unauthenticated HTTP requests to Siebel Marketing URLs originating from unexpected external IP ranges.
Bursts of HTTP 5xx errors or Siebel component restarts correlated with anomalous request patterns.
Access log entries showing responses containing marketing records without an authenticated session cookie or token.
Sudden spikes in outbound data volume from the Siebel Application Object Manager hosting the Marketing component.

Detection Strategies

Baseline expected authenticated access to Siebel Marketing endpoints and alert on unauthenticated request volume above the baseline.
Deploy web application firewall (WAF) signatures aligned with the Oracle August 2026 CPU advisory to flag suspect request patterns.
Correlate Siebel component crash events with preceding HTTP request sequences to identify probing.

Monitoring Recommendations

Forward Siebel web server, application object manager, and infrastructure logs to a centralized analytics platform for retention and query.
Monitor Siebel process availability and restart counts as service-health indicators tied to potential DoS attempts.
Track authentication decisions on Marketing URLs and alert when protected resources are served to sessions lacking a valid principal.

How to Mitigate CVE-2026-60754

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert August 2026 to all Siebel CRM environments running versions 17.0 through 26.6.
Restrict network access to Siebel Marketing endpoints so they are reachable only from trusted networks or through an authenticated reverse proxy.
Inventory all Siebel Apps - Marketing deployments, including test and staging, and prioritize internet-facing instances for patching first.

Patch Information

Oracle addressed CVE-2026-60754 in the August 2026 Critical Patch Update. Administrators should follow the fix instructions and version mapping published in the Oracle Security Alert August 2026 and validate the patch level of each Siebel Application Object Manager instance after deployment.

Workarounds

Place the Siebel Marketing component behind a WAF or reverse proxy that enforces authentication before requests reach the application.
Disable or firewall off the Marketing component in environments where it is not required, pending patch deployment.
Enforce IP allow-lists at the network edge so only known administrative and integration hosts can reach Marketing URLs.

bash

# Example: restrict Siebel Marketing endpoint access at an nginx reverse proxy
# Replace the allow entries with your organization's trusted CIDR ranges
location /siebel/app/marketing/ {
    allow 10.0.0.0/8;
    allow 192.168.10.0/24;
    deny all;
    proxy_pass https://siebel-backend.internal;
}