SB20261107271 - Multiple vulnerabilities in Siebel CRM Cloud Applications

Description

This security bulletin contains information about 23 vulnerabilities.

1) Improper input validation (CVE-ID: CVE-2026-60705)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read, manipulate or delete data.

The vulnerability exists due to improper input validation within the Siebel Cloud Manager component in Siebel CRM Cloud Applications. A remote non-authenticated attacker can exploit this vulnerability to read, manipulate or delete data.

2) Improper input validation (CVE-ID: CVE-2026-60711)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Siebel Cloud Manager component in Siebel CRM Cloud Applications. A remote authenticated user can exploit this vulnerability to execute arbitrary code.

3) Incorrect calculation (CVE-ID: CVE-2026-1229)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to incorrect calculation within the CombinedMult() function in the CIRCL ecc/p384 package (secp384r1 curve). A remote attacker can pass specially crafted input to the application and perform a denial of service attack. 

4) HTTP response splitting (CVE-ID: CVE-2026-34520)

CWE-ID: CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass security controls.

The vulnerability exists due to improper neutralization of control characters in HTTP response headers in the C parser (llhttp) when processing response header values. A remote attacker can send specially crafted header values to bypass security controls.

The issue can cause header values to be interpreted differently than expected by application logic or intermediary components such as reverse proxies.

5) Improper Authorization (CVE-ID: CVE-2026-33186)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to bypass authorization.

The vulnerability exists due to authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server to bypass authorization.

6) Path traversal (CVE-ID: CVE-2026-35204)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to write files to arbitrary locations on the filesystem.

The vulnerability exists due to path traversal in the plugin metadata version field when installing or updating a specially crafted Helm plugin. A remote attacker can provide a specially crafted plugin to write files to arbitrary locations on the filesystem.

User interaction is required to install or update the crafted plugin.

7) Improper input validation (CVE-ID: CVE-2026-60690)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Siebel Cloud Manager component in Siebel CRM Cloud Applications. A remote authenticated user can exploit this vulnerability to gain access to sensitive information.

8) Improper input validation (CVE-ID: CVE-2026-60689)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Siebel Cloud Manager component in Siebel CRM Cloud Applications. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

9) Improper input validation (CVE-ID: CVE-2026-60704)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Siebel Cloud Manager component in Siebel CRM Cloud Applications. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

10) Improper input validation (CVE-ID: CVE-2025-9624)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Siebel Cloud Manager (OpenSearch) component in Siebel CRM Cloud Applications. A remote non-authenticated attacker can exploit this vulnerability to perform a denial of service (DoS) attack.

11) Improper input validation (CVE-ID: CVE-2021-3283)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Siebel Cloud Manager (Traefik) component in Siebel CRM Cloud Applications. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

12) Improper input validation (CVE-ID: CVE-2026-47018)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Siebel Cloud Manager component in Siebel CRM Cloud Applications. A remote non-authenticated attacker can exploit this vulnerability to perform a denial of service (DoS) attack.

13) Improper input validation (CVE-ID: CVE-2026-60709)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 2.3 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Siebel Cloud Manager component in Siebel CRM Cloud Applications. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

14) Improper input validation (CVE-ID: CVE-2026-24051)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Core (OpenTelemetry-Go) component in Oracle Communications Unified Assurance. A local privileged user can exploit this vulnerability to execute arbitrary code.

15) Insufficient verification of data authenticity (CVE-ID: CVE-2026-26007)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the public_key_from_numbers (or EllipticCurvePublicNumbers.public_key()), EllipticCurvePublicNumbers.public_key(), load_der_public_key() and load_pem_public_key() functions do not verify that the point belongs to the expected prime-order subgroup of the curve. A remote attacker can provide a public key point P from a small-order subgroup. This can lead to security issues in various situations, such as the most commonly used signature verification (ECDSA) and shared key negotiation (ECDH). When the victim computes the shared secret as S = [victim_private_key]P via ECDH, this leaks information about victim_private_key mod (small_subgroup_order). For curves with cofactor > 1, this reveals the least significant bits of the private key. When these weak public keys are used in ECDSA , it's easy to forge signatures on the small subgroup.

16) Improper input validation (CVE-ID: CVE-2026-60712)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Siebel Cloud Manager component in Siebel CRM Cloud Applications. A local authenticated user can exploit this vulnerability to gain access to sensitive information.

17) Stored cross-site scripting (CVE-ID: CVE-2026-40179)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote user to execute arbitrary script in the victim's browser.

The vulnerability exists due to cross-site scripting in the Prometheus web UI tooltip and metrics explorer components when rendering crafted metric names or label values. A remote user can inject crafted metrics through a compromised scrape target, remote write, or the OTLP receiver endpoint to execute arbitrary script in the victim's browser.

User interaction is required to view the affected metric in the Graph UI, such as hovering over a chart tooltip, opening the Metric Explorer, or hovering over a heatmap cell.

18) Resource exhaustion (CVE-ID: CVE-2025-13837)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources in Lib/plistlib.py. A remote attacker can pass a specially crafted file to the application, trigger memory exhaustion and perform a denial of service (DoS) attack.

19) Stored cross-site scripting (CVE-ID: CVE-2023-40577)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data passed to the /api/v1/alerts endpoint in the Alertmanager UI. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

20) Asymmetric Resource Consumption (Amplification) (CVE-ID: CVE-2025-68480)

CWE-ID: CWE-405 - Asymmetric Resource Consumption (Amplification)

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a moderately sized request can consume a disproportionate amount of CPU time. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

21) Input validation error (CVE-ID: CVE-2024-39908)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied XML input. A remote attacker can pass specially crafted characters, such as "<", "" and "%>" to the application and perform a denial of service (DoS) attack.

22) Improper input validation (CVE-ID: CVE-2026-60713)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Siebel Cloud Manager component in Siebel CRM Cloud Applications. A local authenticated user can exploit this vulnerability to read and manipulate data.

23) Use of cache containing sensitive information (CVE-ID: CVE-2026-27205)

CWE-ID: CWE-524 - Use of Cache Containing Sensitive Information

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to when the session object is accessed, Flask should set the Vary: Cookie header. The logic instructs caches not to cache the response, as it may contain information specific to a logged in user. This is handled in most cases, but some forms of access such as the Python in operator were overlooked. The severity and risk depend on the application being hosted behind a caching proxy that doesn't ignore responses with cookies, not setting a Cache-Control header to mark pages as private or non-cacheable, and accessing the session in a way that only touches keys without reading values or mutating the session. A remote attacker can gain unauthorized access to sensitive information on the system.

Remediation

Install update from vendor's website.

References

• https://www.oracle.com/security-alerts/cpujul2026.html