Description
Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel Apps - Marketing executes to compromise Siebel Apps - Marketing. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel Apps - Marketing accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Published: 2026-10-20
Score: 5.5 Medium
EPSS: n/a
KEV: No
Impact: Unauthorized Data Access
Action: Apply Patch
AI Analysis

Impact

A local vulnerability in the Oracle Siebel Marketing component permits a low‑privileged attacker who can log onto the infrastructure hosting the application to compromise the Siebel Marketing process. Successful exploitation can lead to unauthorized access to critical data, potentially exposing sensitive customer or marketing information. The flaw is classified as a confidentiality‑only impact with a CVSS base score of 5.5.

Affected Systems

The vulnerability affects the Oracle Siebel Marketing application, versions ranging from 17.0 through 26.9, as part of the Oracle Siebel CRM suite.

Risk and Exploitability

The CVSS 3.1 score of 5.5 indicates moderate severity. Exposure is limited to local attackers with some host access and requires no network connectivity. EPSS data is unavailable, and the issue is not tracked in the CISA KEV catalog, suggesting current exploitation risk is low but present. The attack can be carried out by any user who can log into the underlying infrastructure, making the risk significant for environments that allow broad local access.

Generated by OpenCVE AI on October 20, 2026 at 23:19 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the official Oracle patch released in the October 2026 CPU advisory for Siebel Marketing
  • Restrict local login privileges to only those required for legitimate operations
  • Segment the network so that the Siebel Marketing servers are isolated from general user workstations

Generated by OpenCVE AI on October 20, 2026 at 23:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 23:45:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation in Oracle Siebel Marketing Application
Weaknesses CWE-284
CWE-285

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel Apps - Marketing executes to compromise Siebel Apps - Marketing. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel Apps - Marketing accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
First Time appeared Oracle
Oracle siebel Apps - Marketing
CPEs cpe:2.3:a:oracle:siebel_apps_-_marketing:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle siebel Apps - Marketing
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Oracle Siebel Apps - Marketing
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-20T21:20:34.141Z

Reserved: 2026-09-28T15:40:09.476Z

Link: CVE-2026-101392

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-20T22:17:46.990

Modified: 2026-10-20T22:17:46.990

Link: CVE-2026-101392

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T23:30:08Z

Weaknesses