This vulnerability (CVE-2026-60690) exists in the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications versions 22.3 through 26.5. It allows a low privileged attacker with network access over HTTP to compromise the application, resulting in unauthorized access to critical or all accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact without integrity or availability impact. Although the vulnerability affects Siebel CRM Cloud Applications, it may also impact additional Oracle products due to scope change. Oracle’s July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm a fix for this vulnerability at this time.

Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible within Siebel CRM Cloud Applications. The vulnerability impacts confidentiality significantly but does not affect integrity or availability. The scope change indicates that other Oracle products may be impacted indirectly. This could result in significant data exposure in environments using affected versions of Siebel CRM Cloud Applications.

Oracle has released a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities across Oracle products. However, this advisory does not explicitly confirm a patch or fix for CVE-2026-60690. Therefore, patch status is not yet confirmed — users should monitor the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for updates and apply patches promptly once available. Until a patch is confirmed, organizations should restrict network access to Siebel CRM Cloud Applications to trusted users and networks only, and follow Oracle’s security recommendations for Siebel CRM Cloud Applications. No vendor advisory states that no action is required or that the issue is already mitigated.