Oracle disclosed CVE-2026-62452, a CVSS 9.9 vulnerability in the Siebel Cloud Manager component of Siebel CRM Cloud Applications that lets an unauthenticated attacker compromise the product over HTTP.
What Is It
The flaw sits in the Siebel Cloud Manager component of Oracle's Siebel CRM Cloud Applications. Oracle describes it as easily exploitable: an attacker with network access via HTTP and no credentials, no privileges, and no user interaction can compromise the application. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L, scoring 9.9 (Critical).
Why It Matters
The scope-changed vector (S:C) is what pushes this into the 9.9 range; Oracle explicitly notes that while the vulnerability lives in Siebel CRM Cloud Applications, successful attacks "may significantly impact additional products." The impact profile per Oracle:
- Confidentiality (High): unauthorized access to critical data, or complete access to all Siebel CRM Cloud Applications accessible data
- Integrity (Low): unauthorized update, insert, or delete access to some accessible data
- Availability (Low): ability to cause a partial denial of service
Zero-prerequisite, network-reachable, and blast radius beyond the vulnerable product itself. That combination is the worst case for an internet-facing CRM tier holding customer records.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Siebel CRM Cloud Applications (Oracle Siebel CRM)
- Component: Siebel Cloud Manager
- Affected versions: 22.3 through 26.6 (inclusive)
The affected range spans four years of supported releases, so organizations should not assume a recent deployment is clear.
Patch Status
The CVE was published 2026-08-18 and its NVD record is still in Received status, meaning NVD enrichment and CPE assignment are pending. The record's patch reference points to an Oracle Critical Patch Update Availability document at cspuaug2026.html. That reference has not been independently verified here; the linked advisory has not been confirmed to be live, and no specific fixed version for the 22.3–26.6 range has been confirmed from it. Oracle also publishes Critical Patch Updates on a quarterly cycle, so an off-cycle document name is worth checking against Oracle's security-alerts index rather than trusting the link alone.
Practically: go to Oracle's security alerts page, locate the advisory that actually covers CVE-2026-62452, and take the fixed version and remediation steps from there. Treat any version mapping circulating before that confirmation as provisional, since patch details are frequently revised after initial publication.
CVE-2026-62452 is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing, so no KEV-mandated remediation deadline applies. That absence says nothing about whether the vulnerability is being exploited; the catalog reflects only exploitation CISA has confirmed and elected to publish, and it typically lags real-world activity. Exploitation status here is simply unknown. Verify current KEV status before finalizing remediation timelines, and given the 9.9 rating and unauthenticated attack path, treat patching as urgent regardless.
Sources
- NVD, CVE-2026-62452: https://nvd.nist.gov/vuln/detail/CVE-2026-62452
- Oracle Security Alerts; August 2026 Critical Patch Update: https://www.oracle.com/security-alerts/cspuaug2026.html
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog