CVE-2026-60757: Siebel CRM Auth Bypass Vulnerability

CVE-2026-60757 Overview

CVE-2026-60757 is a high-severity vulnerability in the Oracle Siebel CRM End User product, affecting the Search component. Supported versions 17.0 through 26.6 are affected. An unauthenticated attacker with access to the physical communication segment attached to the Siebel CRM End User hardware can exploit this weakness. Successful exploitation permits unauthorized creation, deletion, or modification of critical data, and grants complete read access to all Siebel CRM End User accessible data. The vulnerability maps to [CWE-284: Improper Access Control].

Critical Impact
Adjacent-network attackers can compromise the confidentiality and integrity of all data accessible to Siebel CRM End User without authentication.

Affected Products

Oracle Siebel CRM End User, version 17.0
Oracle Siebel CRM End User, versions 18.0 through 25.x
Oracle Siebel CRM End User, version 26.6

Discovery Timeline

2026-08-18 - CVE-2026-60757 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-60757

Vulnerability Analysis

The flaw resides in the Search component of the Siebel CRM End User product. Oracle's advisory classifies the issue under improper access control [CWE-284]. An attacker positioned on the same physical communication segment as the Siebel CRM End User host can reach the vulnerable interface without credentials or user interaction. Exploitation results in unauthorized read, write, and delete operations against data accessible to the Siebel CRM End User. Availability is not affected, but confidentiality and integrity are fully compromised.

Root Cause

The underlying weakness is improper access control within the Search component. The component fails to enforce authentication or authorization checks on requests reaching it over the local network segment. Oracle has not published deeper technical detail beyond the advisory summary.

Attack Vector

The attack vector is adjacent-network. An attacker must be on the same broadcast domain, VLAN, or physical link as the Siebel CRM End User host. No credentials or user interaction are required, and attack complexity is low. Because privileges are not required, any adversary with a foothold on the local segment, such as a compromised workstation or rogue device, can reach the vulnerable Search interface.

No verified public proof-of-concept code is available. See the Oracle Security Alert for vendor guidance.

Detection Methods for CVE-2026-60757

Indicators of Compromise

Unexpected search queries or bulk data retrieval events in Siebel CRM audit logs originating from unauthenticated sessions.
Anomalous create, update, or delete operations against Siebel entities from hosts on the same subnet as the CRM server.
Traffic to Siebel Search endpoints from workstations that do not normally interact with the CRM tier.

Detection Strategies

Enable and forward Siebel application, audit, and web server logs to a centralized SIEM for correlation of unauthenticated access to Search endpoints.
Baseline normal Siebel Search traffic patterns and alert on volume spikes or off-hours activity.
Deploy network intrusion detection signatures for anomalous requests to Siebel Search HTTP handlers on the CRM subnet.

Monitoring Recommendations

Monitor east-west traffic on VLANs hosting Siebel CRM servers and flag unauthenticated sessions reaching application ports.
Track privileged data-modification events in Siebel and correlate with source IP reputation and asset ownership.
Alert on new ARP entries or unknown devices appearing on the Siebel server segment.

How to Mitigate CVE-2026-60757

Immediate Actions Required

Apply Oracle's August 2026 Critical Patch Update for Siebel CRM to all instances running versions 17.0 through 26.6.
Restrict network access to the Siebel CRM End User host to authorized management segments using firewall rules or network ACLs.
Audit recent Siebel Search activity for unauthorized data access or modification.

Patch Information

Oracle addressed CVE-2026-60757 in the August 2026 Critical Patch Update. Refer to the Oracle Security Alert for patch identifiers, affected version matrices, and installation instructions. Patching remains the only complete remediation.

Workarounds

Segment the Siebel CRM tier onto an isolated VLAN with strict ingress filtering until patches are deployed.
Enforce 802.1X or MAC-based port authentication on switches serving the CRM segment to block rogue devices.
Disable or restrict access to the Search component if it is not required by end users during the remediation window.

bash

# Example: restrict access to the Siebel CRM host to a management subnet
iptables -A INPUT -s 10.10.20.0/24 -p tcp --dport 2321 -j ACCEPT
iptables -A INPUT -p tcp --dport 2321 -j DROP