This vulnerability in Oracle Siebel CRM Deployment affects versions from 17.0 up to and including 26.6. It allows an unauthenticated attacker with network access via HTTP to compromise the deployment, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all accessible data. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts without availability impact. Oracle's advisory references a Critical Security Patch Update released in August 2026 that addresses numerous vulnerabilities across Oracle products, including Siebel CRM, but does not explicitly confirm a patch for this CVE in the provided text.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Siebel CRM Deployment or unauthorized access to all accessible data. This compromises confidentiality and integrity of the system's data. There is no reported impact on availability. The vulnerability is considered difficult to exploit and requires network access via HTTP without authentication.

Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. The August 2026 Critical Security Patch Update advisory covers this vulnerability among many others. However, the provided advisory content does not explicitly confirm a patch for CVE-2026-60792. Users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch availability and installation instructions. Until patched, no specific mitigations are detailed in the advisory.