Description
Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Email Marketing). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel Apps - Marketing, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel Apps - Marketing accessible data as well as unauthorized read access to a subset of Siebel Apps - Marketing accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Published: 2026-10-20
Score: 6.1 Medium
EPSS: n/a
KEV: No
Impact: Unauthorized data modification and disclosure
Action: Apply Vendor Fix
AI Analysis

Impact

The vulnerability in Oracle Siebel Apps - Marketing permits an unauthenticated attacker with network access to the application’s HTTP interface to perform unauthorized updates, inserts, or deletes on accessible data and to read certain data subsets; it requires human interaction from a user other than the attacker and affects confidentiality and integrity of data.

Affected Systems

Oracle Siebel Apps - Marketing versions from 17.0 through 26.9, part of Oracle Siebel CRM’s Email Marketing component, are impacted by the flaw.

Risk and Exploitability

The CVSS v3.1 Base Score of 6.1 denotes moderate severity with confidentiality and integrity impacts. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog, indicating limited publicly known exploitation. The requirement for user interaction reduces immediate risk, but the scope change suggests that successful exploitation could affect other related products, making it a serious concern for organizations that rely on Siebel Marketing for secure communications.

Generated by OpenCVE AI on October 20, 2026 at 23:09 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply any available Oracle patch or upgrade to a version outside the 17.0–26.9 range.
  • Restrict network access to the Siebel Marketing application to trusted networks or VPNs to reduce the attack surface.
  • Disable external email marketing functions or enforce stricter authentication and authorization checks until remediation is applied.
  • Monitor logs for unusual data modification or read attempts to detect potential exploitation.

Generated by OpenCVE AI on October 20, 2026 at 23:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Leads to Unauthorized Data Manipulation in Siebel Marketing
Weaknesses CWE-284
CWE-639

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Email Marketing). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel Apps - Marketing, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel Apps - Marketing accessible data as well as unauthorized read access to a subset of Siebel Apps - Marketing accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
First Time appeared Oracle
Oracle siebel Apps - Marketing
CPEs cpe:2.3:a:oracle:siebel_apps_-_marketing:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle siebel Apps - Marketing
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Oracle Siebel Apps - Marketing
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-20T21:20:39.962Z

Reserved: 2026-09-28T15:40:09.478Z

Link: CVE-2026-101408

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-20T22:17:48.830

Modified: 2026-10-20T22:17:48.830

Link: CVE-2026-101408

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T23:15:15Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-639

    Authorization Bypass Through User-Controlled Key