Description
Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Email Marketing). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel Apps - Marketing, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel Apps - Marketing accessible data as well as unauthorized read access to a subset of Siebel Apps - Marketing accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Published: 2026-10-20
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data modification and disclosure
Action: Apply Vendor Fix
AI Analysis

Impact

The vulnerability in Oracle Siebel Apps - Marketing permits an unauthenticated attacker with network access to the application’s HTTP interface to perform unauthorized updates, inserts, or deletes on accessible data and to read certain data subsets; it requires human interaction from a user other than the attacker and affects confidentiality and integrity of data.

Affected Systems

Oracle Siebel Apps - Marketing versions from 17.0 through 26.9, part of Oracle Siebel CRM’s Email Marketing component, are impacted by the flaw.

Risk and Exploitability

The CVSS v3.1 Base Score of 6.1 denotes moderate severity with confidentiality and integrity impacts. EPSS score of < 1% indicates a very low, but non‑zero, exploitation probability, and the vulnerability is not listed in CISA's KEV catalog, indicating limited publicly known exploitation. The requirement for user interaction reduces immediate risk, but the scope change suggests that successful exploitation could affect other related products, making it a serious concern for organizations that rely on Siebel Marketing for secure communications.

Generated by OpenCVE AI on November 5, 2026 at 17:30 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply any available Oracle patch or upgrade to a version outside the 17.0–26.9 range.
  • Restrict network access to the Siebel Marketing application to trusted networks or VPNs to reduce the attack surface.
  • Disable external email marketing functions or enforce stricter authentication and authorization checks until remediation is applied.
  • Monitor logs for unusual data modification or read attempts to detect potential exploitation.

Generated by OpenCVE AI on November 5, 2026 at 17:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 07 Nov 2026 07:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 05 Nov 2026 16:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Leads to Unauthorized Data Manipulation in Siebel Marketing
Weaknesses CWE-284
CWE-639

Thu, 05 Nov 2026 13:45:00 +0000

Type Values Removed Values Added
First Time appeared Oracle siebel Crm
Weaknesses CWE-352
CPEs cpe:2.3:a:oracle:siebel_crm:*:*:*:*:*:*:*:*
Vendors & Products Oracle siebel Crm

Tue, 20 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Leads to Unauthorized Data Manipulation in Siebel Marketing
Weaknesses CWE-284
CWE-639

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Email Marketing). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel Apps - Marketing, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel Apps - Marketing accessible data as well as unauthorized read access to a subset of Siebel Apps - Marketing accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
First Time appeared Oracle
Oracle siebel Apps - Marketing
CPEs cpe:2.3:a:oracle:siebel_apps_-_marketing:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle siebel Apps - Marketing
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Oracle Siebel Apps - Marketing Siebel Crm
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-11-06T15:51:27.728Z

Reserved: 2026-09-28T15:40:09.478Z

Link: CVE-2026-101408

cve-icon Vulnrichment

Updated: 2026-11-06T15:51:07.633Z

cve-icon NVD

Status : Modified

Published: 2026-10-20T22:17:48.830

Modified: 2026-11-06T16:17:05.787

Link: CVE-2026-101408

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-05T17:45:06Z

Weaknesses
  • CWE-352

    Cross-Site Request Forgery (CSRF)