Description
Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Siebel Apps - Marketing executes to compromise Siebel Apps - Marketing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel Apps - Marketing accessible data. CVSS 3.1 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N).
Published: 2026-10-20
Score: 4.7 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Integrity compromise and unauthorized data modification.
Action: Apply patch
AI Analysis

Impact

The vulnerability resides in Oracle Siebel Apps – Marketing and allows a local attacker with logon privileges to compromise the application, enabling unauthorized creation, deletion or modification of critical data and thus affecting data integrity. The weakness corresponds to an authorization bypass flaw that permits low‑privileged users to alter data without proper permission checks.

Affected Systems

Oracle Corporation’s Siebel Apps – Marketing versions 17.0 through 26.9 are affected.

Risk and Exploitability

The CVSS v3.1 base score is 4.7, indicating moderate severity with a significant integrity impact. EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog. The attack requires local access (AV:L) and high attack complexity (AC:H) with low privilege (PR:L); no user interaction (UI:N) is needed and scope is unmodified (S:U). The risk of exploitation is therefore limited to environments where a user can obtain local logon to the infrastructure hosting Siebel Apps – Marketing.

Generated by OpenCVE AI on October 22, 2026 at 11:35 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Oracle Siebel Apps – Marketing to a patched version that addresses the integrity flaw.
  • Enforce least‑privilege on all local accounts that have access to the application infrastructure.
  • Configure database and application audit logs to detect and alert on unauthorized data changes.
  • Perform regular backups of critical data and verify restore processes to mitigate accidental or malicious alterations.

Generated by OpenCVE AI on October 22, 2026 at 11:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 09 Nov 2026 18:00:00 +0000

Type Values Removed Values Added
First Time appeared Oracle siebel Crm
CPEs cpe:2.3:a:oracle:siebel_crm:*:*:*:*:*:*:*:*
Vendors & Products Oracle siebel Crm

Thu, 22 Oct 2026 12:00:00 +0000

Type Values Removed Values Added
Title Siebel Apps – Marketing Local Authorization Bypass Allows Unauthorized Data Modification

Thu, 22 Oct 2026 10:45:00 +0000

Type Values Removed Values Added
Title Local Privileged Data Modification in Oracle Siebel Apps – Marketing
Weaknesses CWE-640

Thu, 22 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Tue, 20 Oct 2026 23:45:00 +0000

Type Values Removed Values Added
Title Local Privileged Data Modification in Oracle Siebel Apps – Marketing
Weaknesses CWE-640

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Siebel Apps - Marketing executes to compromise Siebel Apps - Marketing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel Apps - Marketing accessible data. CVSS 3.1 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N).
First Time appeared Oracle
Oracle siebel Apps - Marketing
CPEs cpe:2.3:a:oracle:siebel_apps_-_marketing:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle siebel Apps - Marketing
References
Metrics cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N'}

Subscriptions

Oracle Siebel Apps - Marketing Siebel Crm
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-21T13:54:49.520Z

Reserved: 2026-09-28T15:40:09.477Z

Link: CVE-2026-101396

cve-icon Vulnrichment

Updated: 2026-10-21T13:54:37.006Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:17:47.453

Modified: 2026-11-09T17:41:31.880

Link: CVE-2026-101396

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T11:45:04Z

Weaknesses