CVE-2026-60791: Siebel CRM Authentication Bypass Flaw

CVE-2026-60791 Overview

CVE-2026-60791 is an access control weakness in the Application Interface component of Oracle Siebel CRM Deployment. Supported versions 17.0 through 26.6 are affected. An unauthenticated attacker with access to the physical communication segment attached to the hardware running Siebel CRM Deployment can compromise the product. Successful exploitation results in unauthorized creation, deletion, or modification of critical data, and unauthorized read access to all Siebel CRM Deployment accessible data. The weakness maps to [CWE-284] Improper Access Control.

Critical Impact
Adjacent-network attackers can read and modify all data accessible to the Siebel CRM Deployment without authentication or user interaction.

Affected Products

Oracle Siebel CRM Deployment 17.0 through 26.6
Component: Application Interface
Environments exposing Siebel CRM on a shared physical or Layer 2 network segment

Discovery Timeline

2026-08-18 - CVE-2026-60791 published to the National Vulnerability Database
2026-08-20 - Last updated in NVD database
August 2026 - Oracle publishes fix in the Oracle Security Alert

Technical Details for CVE-2026-60791

Vulnerability Analysis

The vulnerability resides in the Application Interface of the Siebel CRM Deployment product. Oracle classifies the flaw as easily exploitable and reachable across an adjacent network. The attacker requires no credentials, no user interaction, and no elevated privileges.

Successful exploitation yields high confidentiality and high integrity impact against all data accessible to the Siebel CRM Deployment. Availability is not affected. Because the weakness is categorized under [CWE-284] Improper Access Control, the Application Interface fails to enforce authorization checks on requests originating from the local communication segment.

At publication, no public proof-of-concept exploit exists, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is low, but the ease of exploitation on any adjacent host makes internal network segmentation the primary compensating control.

Root Cause

The Application Interface accepts and processes requests from clients on the same physical communication segment without adequately validating the requester's identity or authorization. This missing enforcement allows an unauthenticated peer on the Layer 2 network to invoke sensitive operations that should require an authenticated Siebel session.

Attack Vector

An attacker must have a foothold on the same physical or logical broadcast domain as the Siebel Application Interface host. This includes an adjacent VLAN, wireless segment, or compromised endpoint on the corporate LAN. From that position, the attacker sends crafted requests to the Application Interface and directly reads or modifies Siebel-accessible records. Public exploitation code is not available. Consult the Oracle Security Alert for vendor-supplied technical details.

Detection Methods for CVE-2026-60791

Indicators of Compromise

Unauthenticated or anonymous session activity recorded in Siebel Application Interface logs originating from unexpected internal hosts
Unexplained creation, modification, or deletion of Siebel business component records outside change-management windows
Application Interface requests from IP addresses on adjacent VLANs that are not designated Siebel clients

Detection Strategies

Baseline normal Siebel Application Interface client IP ranges and alert on deviations from the expected client subnets
Correlate Siebel audit trail entries with authentication events to identify data changes that lack a preceding user login
Review Application Interface access logs for high request volumes from a single adjacent host targeting Siebel object manager endpoints

Monitoring Recommendations

Forward Siebel Application Interface, web tier, and OS logs to a centralized SIEM for correlation with network flow data
Enable Siebel audit trail on high-value business components to capture unauthorized write operations
Monitor Layer 2 telemetry, including ARP tables and switch port activity, for unexpected devices on the Siebel server segment

How to Mitigate CVE-2026-60791

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert to all affected Siebel CRM Deployment instances between versions 17.0 and 26.6
Inventory every Siebel Application Interface host and confirm patch status against the Oracle-supplied version manifest
Restrict network access to the Siebel Application Interface to a dedicated management VLAN protected by a stateful firewall

Patch Information

Oracle addressed CVE-2026-60791 in the August 2026 Critical Patch Update. Administrators should download the applicable patch bundle for Siebel CRM 17.0 through 26.6 from My Oracle Support and follow Oracle's documented patch application procedure. Full advisory details are available in the Oracle Security Alert.

Workarounds

Place Siebel Application Interface servers on an isolated VLAN and enforce access control lists that permit only authorized client subnets
Deploy private VLANs or port isolation on switches serving the Siebel infrastructure to prevent peer-to-peer traffic from unrelated hosts
Require mutual TLS or reverse-proxy authentication in front of the Application Interface until the Oracle patch is deployed

bash

# Example ACL restricting Application Interface access to a jump subnet
# Replace 10.10.20.0/24 with the authorized Siebel client subnet
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP