This vulnerability affects Oracle Siebel CRM Cloud Applications versions 22.3 through 26.5 and involves a weakness in the Siebel Cloud Manager component. An unauthenticated attacker who has physical access to the communication segment connected to the hardware running the application can exploit this issue to gain unauthorized update, insert, delete, and read access to some of the application's accessible data. The attack vector requires physical network access, making exploitation difficult. The CVSS 3.1 vector is AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, indicating attack complexity is high, no privileges or user interaction are required, and the impact is limited to low confidentiality and integrity loss without availability impact. Oracle's advisory does not explicitly confirm a patch or remediation level for this specific vulnerability but strongly recommends applying Critical Patch Updates regularly.

Successful exploitation can lead to unauthorized read and modification (update, insert, delete) of some accessible data within Siebel CRM Cloud Applications. There is no impact on availability. The vulnerability requires physical access to the communication segment attached to the hardware, limiting the attack surface. The confidentiality and integrity impacts are low, as reflected by the CVSS score of 4.2. No known exploits have been reported in the wild.

Oracle has not explicitly confirmed a patch or remediation for CVE-2026-60709 in the provided advisory. Customers are strongly advised to remain on actively supported versions and apply Oracle Critical Patch Updates promptly as they become available. Since the vulnerability requires physical access to the communication segment, restricting physical access to hardware and network segments hosting Siebel CRM Cloud Applications can reduce risk. Monitor Oracle's security advisories for updates regarding patches or official fixes for this vulnerability.