Description
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Siebel CRM Cloud Applications. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Published: 2026-10-20
Score: 9.9 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution and Application Takeover
Action: Immediate Patch
AI Analysis

Impact

The vulnerability exists in the Siebel Cloud Manager component where a low-privileged attacker who can reach the system over HTTP can compromise the entire application. This flaw involves improper input validation (CWE-20) and improper access control (CWE-284). Successful exploitation can lead to full takeover, affecting confidentiality, integrity, and availability.

Affected Systems

Affected products are Oracle Siebel CRM Cloud Applications, component versions ranging from 17.0 to 26.9. This spans nearly a decade of releases, covering both older and newer editions of the cloud platform.

Risk and Exploitability

The CVSS 3.1 base score of 9.9 indicates extremely high severity, and the vector shows that the attacker needs only network access and low privileges, with no user interaction required. EPSS score is < 1%, indicating a very low exploit probability. The vulnerability is not yet listed in CISA’s KEV catalog, but the scope change could allow compromise of additional products in the environment.

Generated by OpenCVE AI on November 5, 2026 at 20:36 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch or upgrade to a released version that addresses the Cloud Manager vulnerability
  • Restrict HTTP access to the Siebel Cloud Manager to trusted networks, a VPN, or firewall rules, limiting exposure to only authorized users
  • Verify that role‑based access controls are properly configured for Siebel Cloud Manager functions
  • Enable and regularly review audit logs for authentication and configuration changes, and configure alerting for suspicious activity

Generated by OpenCVE AI on November 5, 2026 at 20:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 06 Nov 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 05 Nov 2026 21:00:00 +0000

Type Values Removed Values Added
Title Siebel CRM Cloud Applications Vulnerability Allows Low-Privilege HTTP Attack to Take Over Application

Thu, 05 Nov 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Wed, 04 Nov 2026 05:15:00 +0000

Type Values Removed Values Added
Title Siebel CRM Cloud Applications Vulnerability Allows Low-Privilege HTTP Attack to Take Over Application

Wed, 04 Nov 2026 02:00:00 +0000

Type Values Removed Values Added
Title Siebel CRM Cloud: Remote Takeover via HTTP in Cloud Manager
Weaknesses CWE-284
CWE-94

Tue, 03 Nov 2026 21:15:00 +0000

Type Values Removed Values Added
First Time appeared Oracle siebel Crm
Weaknesses CWE-20
CPEs cpe:2.3:a:oracle:siebel_crm:*:*:*:*:*:*:*:*
Vendors & Products Oracle siebel Crm

Wed, 21 Oct 2026 06:30:00 +0000

Type Values Removed Values Added
Title Siebel CRM Cloud: Remote Takeover via HTTP in Cloud Manager
Weaknesses CWE-284
CWE-94

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Siebel CRM Cloud Applications. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
First Time appeared Oracle
Oracle siebel Crm Cloud Applications
CPEs cpe:2.3:a:oracle:siebel_crm_cloud_applications:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle siebel Crm Cloud Applications
References
Metrics cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Oracle Siebel Crm Siebel Crm Cloud Applications
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-11-05T18:18:29.899Z

Reserved: 2026-09-28T15:40:09.482Z

Link: CVE-2026-101446

cve-icon Vulnrichment

Updated: 2026-11-05T18:10:33.107Z

cve-icon NVD

Status : Modified

Published: 2026-10-20T22:17:53.193

Modified: 2026-11-05T19:17:02.403

Link: CVE-2026-101446

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-05T20:45:07Z

Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-284

    Improper Access Control