PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-70857 Oracle Corporation CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-18T21:17:41.867Z and has not been modified since then. The vulnerability affects Siebel CRM End User versions 17.0-26.6 and has a CVSS 3.1 Base Score of 7.7, indicating high confidentiality and integrity impacts. Organizations should verify their deployments and apply patches or mitigations as necessary. There is no information available on whether the vulnerability has been publicly exploited or used in ransomware campaigns. The CVE-2026-70857 record indicates that difficult to exploit vulnerability allows low privileged attacker with network access via HTTPS to compromise Siebel CRM End User. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel CRM End User, attacks may significantly impact additional products (scope change).

Vendor
Oracle Corporation
Product
Siebel CRM End User
CVSS
HIGH 7.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-18
Original CVE updated
2026-08-21
Advisory published
2026-08-18
Advisory updated
2026-08-21

Who should care

Organizations using Oracle Siebel CRM End User versions 17.0-26.6 should prioritize patching this vulnerability to prevent potential exploitation. Security teams and vulnerability management teams should review the CVE record and apply patches or mitigations as necessary. Operators and administrators of Siebel CRM End User should also be aware of the vulnerability and take necessary precautions to prevent exploitation.

Technical summary

The vulnerability in Oracle Siebel CRM End User (component: Open UI) allows low-privileged attackers with network access via HTTPS to compromise the system, requiring human interaction for successful attacks. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data or all Siebel CRM End User accessible data, as well as unauthorized access to critical data or complete access to all Siebel CRM End User accessible data. The CVSS 3.1 Base Score is 7.7, indicating high confidentiality and integrity impacts.

Defensive priority

Oracle Siebel CRM End User vulnerability allows low-privileged attackers with network access via HTTPS to compromise the system, requiring human interaction for successful attacks.

Recommended defensive actions

  • Review and apply Oracle's security patches for Siebel CRM End User
  • Restrict network access to Siebel CRM End User to only necessary personnel
  • Monitor Siebel CRM End User systems for suspicious activity
  • Implement additional security controls to prevent exploitation
  • Conduct regular vulnerability assessments and penetration testing
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability affects Siebel CRM End User versions 17.0-26.6 and has a CVSS 3.1 Base Score of 7.7, indicating high confidentiality and integrity impacts. The CVE record was published on 2026-08-18T21:17:41.867Z and has not been modified since then. There is no information available on whether the vulnerability has been publicly exploited or used in ransomware campaigns. Organizations should verify their deployments and apply patches or mitigations as necessary.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-18T21:17:41.867Z and has not been modified since then.