Description
Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel Apps - Marketing accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
Published: 2026-10-20
Score: 3.7 Low
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized read of sensitive data
Action: Patch Now
AI Analysis

Impact

A flaw in the Siebel Apps - Marketing component of Oracle Siebel CRM permits an unauthenticated attacker who can reach the product over HTTP to read a subset of data that the application exposes. The attack does not require credentials or privileged access, meaning any network reach to the service can trigger a confidentiality breach. The vulnerability does not affect integrity or availability components of the application.

Affected Systems

Oracle Siebel Apps - Marketing versions 17.0 through 26.9 are affected. The flaw resides in the Marketing component of the broader Siebel CRM product.

Risk and Exploitability

The CVSS base score of 3.7 indicates a low‑severity impact focused solely on confidentiality. EPSS is reported as less than 1%, suggesting a low but not zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a simple HTTP request over the network, with no authentication or other special conditions required to read protected data.

Generated by OpenCVE AI on November 5, 2026 at 16:27 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the official Oracle patch or update for CVE-2026‑101406.
  • Restrict HTTP access to the Siebel Apps - Marketing instance to trusted networks or enforce firewall rules to limit exposure.
  • Enable detailed logging for read operations and routinely review logs for unauthorized access attempts.

Generated by OpenCVE AI on November 5, 2026 at 16:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 07 Nov 2026 07:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 05 Nov 2026 16:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Data Read Vulnerability in Oracle Siebel Marketing

Thu, 05 Nov 2026 15:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Network Access Confers Unauthorized Read in Siebel Apps - Marketing 17.0-26.9
Weaknesses CWE-284
CWE-287

Thu, 05 Nov 2026 13:45:00 +0000

Type Values Removed Values Added
First Time appeared Oracle siebel Crm
Weaknesses CWE-306
CPEs cpe:2.3:a:oracle:siebel_crm:*:*:*:*:*:*:*:*
Vendors & Products Oracle siebel Crm

Tue, 20 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Network Access Confers Unauthorized Read in Siebel Apps - Marketing 17.0-26.9
Weaknesses CWE-284
CWE-287

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel Apps - Marketing accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle siebel Apps - Marketing
CPEs cpe:2.3:a:oracle:siebel_apps_-_marketing:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle siebel Apps - Marketing
References
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Siebel Apps - Marketing Siebel Crm
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-11-06T15:48:43.847Z

Reserved: 2026-09-28T15:40:09.478Z

Link: CVE-2026-101406

cve-icon Vulnrichment

Updated: 2026-11-06T15:48:23.231Z

cve-icon NVD

Status : Modified

Published: 2026-10-20T22:17:48.580

Modified: 2026-11-06T16:17:05.627

Link: CVE-2026-101406

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-05T16:30:12Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function