Description
Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Siebel Apps - Marketing executes to compromise Siebel Apps - Marketing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel Apps - Marketing accessible data. CVSS 3.1 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N).
Published: 2026-10-20
Score: 4.7 Medium
EPSS: n/a
KEV: No
Impact: Integrity compromise and unauthorized data modification.
Action: Apply patch
AI Analysis

Impact

The vulnerability resides in Oracle Siebel Apps – Marketing and allows a local attacker with logon privileges to compromise the application. This results in unauthorized creation, deletion or modification of critical data, thereby affecting data integrity. The weakness corresponds to an authorization bypass flaw that permits low‑privileged users to alter data without proper permission checks.

Affected Systems

Oracle Corporation’s Siebel Apps – Marketing versions 17.0 through 26.9 are affected.

Risk and Exploitability

The CVSS v3.1 base score is 4.7, indicating moderate severity with a significant integrity impact. EPSS information is not available and the vulnerability is not listed in the CISA KEV catalog. The attack requires local access (AV:L) and high attack complexity (AC:H) with low privilege (PR:L); no user interaction (UI:N) is needed and scope is unmodified (S:U). The risk of exploitation is therefore limited to environments where a user can obtain local logon to the infrastructure hosting Siebel Apps – Marketing.

Generated by OpenCVE AI on October 20, 2026 at 23:17 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Oracle Siebel Apps – Marketing to a patched version that addresses the integrity flaw.
  • Enforce least‑privilege on all local accounts that have access to the application infrastructure.
  • Configure database and application audit logs to detect and alert on unauthorized data changes.
  • Perform regular backups of critical data and verify restore processes to mitigate accidental or malicious alterations.

Generated by OpenCVE AI on October 20, 2026 at 23:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 23:45:00 +0000

Type Values Removed Values Added
Title Local Privileged Data Modification in Oracle Siebel Apps – Marketing
Weaknesses CWE-640

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Siebel Apps - Marketing executes to compromise Siebel Apps - Marketing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel Apps - Marketing accessible data. CVSS 3.1 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N).
First Time appeared Oracle
Oracle siebel Apps - Marketing
CPEs cpe:2.3:a:oracle:siebel_apps_-_marketing:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle siebel Apps - Marketing
References
Metrics cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N'}

Subscriptions

Oracle Siebel Apps - Marketing
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-20T21:20:35.513Z

Reserved: 2026-09-28T15:40:09.477Z

Link: CVE-2026-101396

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-20T22:17:47.453

Modified: 2026-10-20T22:17:47.453

Link: CVE-2026-101396

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T23:30:08Z

Weaknesses
  • CWE-640

    Weak Password Recovery Mechanism for Forgotten Password