CVE-2026-60779: Oracle Siebel CRM Auth Bypass Vulnerability

CVE-2026-60779 Overview

CVE-2026-60779 is an access control weakness [CWE-284] in the Siebel Apps - Marketing component of Oracle Siebel CRM. Supported versions 17.0 through 26.6 are affected. A low-privileged attacker with network access via HTTP can compromise the application without user interaction. Successful exploitation permits unauthorized creation, deletion, or modification of critical data accessible to Siebel Apps - Marketing. Attackers can also trigger a hang or repeatable crash, producing a complete denial of service.

Critical Impact
Authenticated network attackers can tamper with or destroy marketing data and take the Siebel Apps - Marketing service offline.

Affected Products

Oracle Siebel CRM - Siebel Apps - Marketing, versions 17.0 through 26.6
Marketing component of Oracle Siebel CRM
Deployments exposing the Siebel Apps - Marketing HTTP interface to authenticated users

Discovery Timeline

2026-08-18 - CVE-2026-60779 published to the National Vulnerability Database (NVD)
2026-08-20 - Last updated in the NVD database
2026-08-20 - EPSS score published at 0.352% (percentile 28.475)

Technical Details for CVE-2026-60779

Vulnerability Analysis

The flaw resides in the Marketing component of Oracle Siebel CRM's Siebel Apps - Marketing product. Oracle classifies the issue as easily exploitable over the network via HTTP. Exploitation requires only low-level privileges and no user interaction. A successful attack does not disclose confidential data but grants full write access to marketing data and can crash the service entirely. The scope remains unchanged, so impact is bounded to the vulnerable component. Oracle's advisory groups this among integrity and availability impacts.

Root Cause

The underlying weakness is improper access control [CWE-284]. The Marketing component fails to enforce appropriate authorization checks on HTTP-accessible functionality. As a result, a user with minimal privileges can invoke operations that should be restricted to higher-trust roles. Oracle has not published implementation-level details in the public advisory.

Attack Vector

The attack vector is network based. An authenticated adversary sends crafted HTTP requests to the Siebel Apps - Marketing endpoint. Because the component performs insufficient authorization on the targeted operations, requests that would otherwise be blocked succeed. The attacker can then create, alter, or delete marketing records or drive the service into a repeatable crash state. Consult the Oracle Security Alert for authoritative technical detail.

// No verified public proof-of-concept is available.
// Refer to the Oracle Security Alert for technical details:
// https://www.oracle.com/security-alerts/cspuaug2026.html

Detection Methods for CVE-2026-60779

Indicators of Compromise

Unexpected create, update, or delete events against Siebel marketing records performed by low-privileged user accounts
Repeated HTTP requests to Siebel Apps - Marketing endpoints immediately preceding service crashes or hangs
Restarts or unavailability of Siebel Apps - Marketing processes correlated with authenticated user traffic

Detection Strategies

Baseline typical request rates and administrative actions per Siebel role, then alert on deviations from low-privileged accounts
Correlate Siebel application logs with web server logs to identify HTTP requests that trigger error conditions or component restarts
Monitor audit trails for data modification events that lack a corresponding legitimate business workflow

Monitoring Recommendations

Forward Siebel application, audit, and web tier logs to a centralized SIEM for continuous review
Enable verbose HTTP access logging on Siebel web extensions and Application Object Managers
Track process availability and crash counters for Siebel Apps - Marketing services to detect denial-of-service attempts

How to Mitigate CVE-2026-60779

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert to affected Siebel CRM deployments
Inventory all Siebel Apps - Marketing instances running versions 17.0 through 26.6 and prioritize patching
Review and tighten role assignments so only required users retain access to the Marketing component

Patch Information

Oracle addresses CVE-2026-60779 in the August 2026 security alert cycle. Administrators should consult the Oracle Security Alert for the specific patch bundles applicable to their Siebel CRM version. Apply patches in a staged environment before production rollout.

Workarounds

Restrict network access to the Siebel Apps - Marketing HTTP endpoints using firewall rules or reverse proxy allow-lists
Enforce strict role-based access control and remove Marketing component privileges from accounts that do not require them
Deploy a web application firewall in front of Siebel to inspect and rate-limit HTTP requests to the Marketing component

bash

# Example: restrict access to the Siebel Apps - Marketing endpoint at the reverse proxy
# (adjust paths and IP ranges to match your deployment)
location /siebel/app/marketing/ {
    allow 10.0.0.0/8;
    deny  all;
    proxy_pass http://siebel-backend;
}