This vulnerability (CVE-2026-60712) exists in the Siebel CRM Cloud Applications product from Oracle, specifically in the Siebel Cloud Manager component. It affects supported versions from 22.3 to 26.5. The flaw allows an attacker with low privileges and logon access to the infrastructure where the application runs to compromise the application, potentially gaining unauthorized access to critical or all accessible data. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) indicates local attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact without affecting integrity or availability. The vulnerability's scope change means it could impact additional Oracle products beyond Siebel CRM Cloud Applications. No known exploits in the wild have been reported. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation status for this specific issue.

An attacker with low privileges and logon access to the infrastructure hosting Siebel CRM Cloud Applications can exploit this vulnerability to gain unauthorized access to critical or all accessible data within the application. The confidentiality impact is high, but there is no impact on data integrity or availability. The vulnerability's scope change may affect additional Oracle products beyond Siebel CRM Cloud Applications.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends that customers remain on actively-supported versions and apply security patches promptly as part of their Critical Patch Update process. Until a patch is confirmed and applied, restrict logon access to the infrastructure hosting Siebel CRM Cloud Applications to trusted users only.