CVE-2026-60803: Oracle Siebel CRM Auth Bypass Vulnerability

CVE-2026-60803 Overview

CVE-2026-60803 affects the Siebel Apps - Marketing product of Oracle Siebel CRM, specifically the Marketing component. The vulnerability impacts supported versions 17.0 through 26.6. An unauthenticated remote attacker with network access via HTTP can exploit this flaw, though successful attacks require overcoming high complexity conditions.

Successful exploitation results in unauthorized creation, deletion, or modification of critical data. Attackers can also gain unauthorized read access to all Siebel Apps - Marketing accessible data. Oracle assigned this vulnerability a CVSS 3.1 base score of 7.4, reflecting high confidentiality and integrity impacts.

Critical Impact
Unauthenticated network attackers can compromise data confidentiality and integrity across all Siebel Apps - Marketing accessible data.

Affected Products

Oracle Siebel CRM - Siebel Apps - Marketing (Marketing component)
Versions 17.0 through 26.6
Deployments exposing the Marketing component over HTTP

Discovery Timeline

2026-08-18 - CVE-2026-60803 published to the National Vulnerability Database (NVD)
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-60803

Vulnerability Analysis

The vulnerability resides in the Marketing component of Oracle Siebel CRM's Siebel Apps - Marketing product. An attacker requires no authentication and no user interaction to attempt exploitation. The attack complexity is high, meaning the attacker must satisfy specific preconditions outside their direct control to succeed.

Despite the elevated complexity, the outcome is significant. Successful exploitation grants full read access to all data accessible by Siebel Apps - Marketing. It also enables unauthorized creation, deletion, or modification of that data, undermining both confidentiality and integrity.

The scope remains unchanged, meaning the impact is bounded to the vulnerable component's security authority. Availability is not directly impacted by this flaw. Oracle disclosed the issue through its August 2026 Critical Patch Update advisory.

Root Cause

Oracle has not published root cause details in the public advisory. The Marketing component processes HTTP requests reachable over the network without requiring credentials, and inadequate validation or access control in this request path enables unauthorized data operations. Refer to the Oracle Security Alert for the authoritative advisory.

Attack Vector

Exploitation occurs over the network via HTTP. The attacker does not need valid credentials or user interaction. Because the Marketing component is often exposed to internal users and integrated partners, network reachability from an untrusted segment is the primary precondition. The high attack complexity indicates the attacker must control or observe conditions such as timing, session state, or specific application configuration.

No verified public proof-of-concept exploit code is available at the time of publication. The current EPSS probability is 0.318%.

Detection Methods for CVE-2026-60803

Indicators of Compromise

Unexpected HTTP requests targeting Siebel Marketing component endpoints from unauthenticated sessions
Unusual creation, modification, or deletion events in Marketing data tables outside normal business workflows
Anomalous outbound data volumes from Siebel application servers correlated with Marketing component access

Detection Strategies

Enable verbose HTTP access logging on Siebel web servers and forward logs to a centralized analytics platform
Baseline normal Marketing component request patterns and alert on deviations in URI structure, request rate, or source IP reputation
Correlate database audit records for Marketing tables with authenticated user sessions to surface unauthenticated modifications

Monitoring Recommendations

Monitor Siebel application server logs for repeated failed or malformed requests to Marketing endpoints
Track database change activity on Marketing schemas with row-level audit trails
Alert on Siebel service accounts performing data operations without a corresponding user session

How to Mitigate CVE-2026-60803

Immediate Actions Required

Apply the fixes referenced in the Oracle Critical Patch Update advisory for August 2026 as soon as change windows allow
Inventory Siebel Apps - Marketing deployments and confirm versions between 17.0 and 26.6 are prioritized for patching
Restrict network exposure of the Marketing component to trusted network segments and authenticated reverse proxies

Patch Information

Oracle addresses this vulnerability in the August 2026 Critical Patch Update. Consult the Oracle Security Alert for the patch matrix, applicability notes, and download locations tied to your specific Siebel version.

Workarounds

Place the Siebel Marketing component behind a web application firewall (WAF) with rules blocking unauthenticated access to sensitive endpoints
Enforce network segmentation so only approved internal networks and VPN clients can reach the Marketing component
Enable database-level auditing on Marketing schemas to detect and roll back unauthorized modifications until patches are deployed

bash

# Example: restrict access to Siebel Marketing endpoints at the reverse proxy
# nginx snippet - allow only trusted subnets to reach the Marketing path
location /siebel/app/marketing/ {
    allow 10.10.0.0/16;
    allow 10.20.0.0/16;
    deny  all;
    proxy_pass http://siebel_backend;
}