Description
Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel Apps - Marketing accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
Published: 2026-10-20
Score: 3.7 Low
EPSS: n/a
KEV: No
Impact: Unauthorized read of sensitive data
Action: Apply Patch
AI Analysis

Impact

A flaw in the Siebel Apps - Marketing component of Oracle Siebel CRM allows an unauthenticated attacker who can reach the product over HTTP to read a subset of accessible data. The vulnerability does not require authentication or special privileges, meaning an attacker only needs network access to the service. This results in a confidentiality breach but does not affect integrity or availability.

Affected Systems

Oracle Siebel Apps - Marketing versions 17.0 through 26.9 are affected. The vulnerability applies to the Marketing component of the Siebel CRM product, which is used by organizations to manage marketing processes.

Risk and Exploitability

The CVSS vector indicates a low-severity threat (3.7 score), with confidentiality impact only. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a simple network-based HTTP request; no authentication is required, so an attacker can exploit the flaw from any connected network location.

Generated by OpenCVE AI on October 20, 2026 at 23:11 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the official Oracle patch or update for CVE-2026-101406.
  • Restrict HTTP access to the Siebel Apps - Marketing instance to trusted networks or enforce firewall rules to limit exposure.
  • Enable detailed logging for read operations and routinely review logs for unauthorized access attempts.

Generated by OpenCVE AI on October 20, 2026 at 23:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Network Access Confers Unauthorized Read in Siebel Apps - Marketing 17.0-26.9
Weaknesses CWE-284
CWE-287

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel Apps - Marketing accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle siebel Apps - Marketing
CPEs cpe:2.3:a:oracle:siebel_apps_-_marketing:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle siebel Apps - Marketing
References
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Siebel Apps - Marketing
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-20T21:20:38.968Z

Reserved: 2026-09-28T15:40:09.478Z

Link: CVE-2026-101406

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-20T22:17:48.580

Modified: 2026-10-20T22:17:48.580

Link: CVE-2026-101406

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T23:15:15Z

Weaknesses