Oracle disclosed a CVSS 9.8 vulnerability in the Open Integration component of Siebel CRM Integration that lets an unauthenticated attacker take over the product over HTTP with no user interaction.
What Is It
CVE-2026-62592 is a critical vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM, specifically in the Open Integration component. Per Oracle's advisory, the flaw is easily exploitable and allows an unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration. Successful exploitation can result in full takeover of Siebel CRM Integration.
The CVSS 3.1 base score is 9.8 (CRITICAL), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network attack vector, low attack complexity, no privileges required, no user interaction, and high impact to confidentiality, integrity, and availability. The exploitability subscore is 3.9, the maximum for this metric set.
Why It Matters
Every barrier that normally slows an attacker down is absent here: no credentials, no user interaction, no local access, and low complexity. Any exposure of the affected integration endpoint to a network an attacker can reach is enough. The stated outcome is takeover of the component, not merely data disclosure; meaning confidentiality, integrity, and availability all fall together.
CISA has not added CVE-2026-62592 to the Known Exploited Vulnerabilities catalog, so there is no confirmation of active exploitation in the wild at this time. That does not lower the urgency of patching a 9.8 unauthenticated takeover.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Siebel CRM Integration (Oracle Siebel CRM)
- Component: Open Integration
- Affected versions: supported versions 25.12 through 26.6
No CPE entries were published with the record at the time of writing.
Patch Status
Oracle published the vulnerability in its July 2026 Critical Patch Update, which is the sole reference on the CVE record and the place where fixed-version and patch details for affected deployments are documented. The CVE record itself reached NVD on 2026-08-18 and still carries a status of "Received," meaning NVD analysis is pending; a normal lag between vendor disclosure in a Critical Patch Update and enrichment of the corresponding NVD entry, not a second or later disclosure event.
Oracle issues Critical Patch Updates on a fixed quarterly cycle, January, April, July, and October, so the July 2026 CPU is the relevant release for this issue, and the next scheduled update falls in October 2026. No specific remediation deadline or required-action directive was supplied in the source material. Administrators running Siebel CRM Integration 25.12–26.6 should consult the Oracle advisory and apply the corresponding update.
Sources
- Oracle Critical Patch Update Advisory (July 2026), https://www.oracle.com/security-alerts/cpujul2026.html
- NVD, CVE-2026-62592, https://nvd.nist.gov/vuln/detail/CVE-2026-62592
- CISA Known Exploited Vulnerabilities Catalog; https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- Oracle Critical Patch Updates, Security Alerts and Bulletins (release schedule), https://www.oracle.com/security-alerts/