Description
Vulnerability in the Siebel Life Sciences product of Oracle Siebel CRM (component: Web UI). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Life Sciences. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel Life Sciences, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel Life Sciences accessible data as well as unauthorized access to critical data or complete access to all Siebel Life Sciences accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).
Published: 2026-10-20
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Modification and Access
Action: Immediate Patch
AI Analysis

Impact

Vulnerability located in the Web UI component of Oracle Siebel Life Sciences can be leveraged by an attacker with low privileges who has network access. This flaw arises from broken access control (CWE‑284) and cross‑site request forgery (CWE‑352), permitting unauthorized creation, deletion, or modification of critical data, and can ultimately grant full access to all data accessible through the application. Attackers must induce a human user, other than themselves, to interact with the application, indicating a user‑interaction requirement.

Affected Systems

Affected vendor and product are Oracle Corporation’s Siebel Life Sciences, a component of Siebel CRM. The vulnerability applies to all supported versions from 17.0 through 26.9 inclusive. These versions remain exposed until patched.

Risk and Exploitability

The CVSS 3.1 base score of 8.7 reflect significant confidentiality and integrity impacts. The EPSS score is less than 1%, indicating a very low probability of exploitation, and the issue is not listed in CISA KEV. The combination of network‑based attack vector, low privilege and the requirement for user interaction yields a realistic high‑risk scenario. Rapid patching is advised because exploitation can result in complete data compromise.

Generated by OpenCVE AI on November 3, 2026 at 19:54 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the official Oracle patch for Siebel Life Sciences released in October 2026.
  • If an immediate patch cannot be applied, restrict HTTP/HTTPS access to the vulnerable Web UI to trusted administrators and/or limit it to a VPN or dedicated network segment.
  • Enforce strict access controls and monitor application logs for suspicious modification attempts; require users to verify unexpected data changes.

Generated by OpenCVE AI on November 3, 2026 at 19:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 10 Nov 2026 00:15:00 +0000

Type Values Removed Values Added
First Time appeared Oracle siebel Crm
CPEs cpe:2.3:a:oracle:siebel_crm:*:*:*:*:*:*:*:*
Vendors & Products Oracle siebel Crm

Tue, 03 Nov 2026 18:15:00 +0000

Type Values Removed Values Added
Title Low‑Privilege Web UI Exploit in Oracle Siebel Life Sciences Enables Unauthorized Data Access
Weaknesses CWE-79

Tue, 03 Nov 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-352
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Title Low‑Privilege Web UI Exploit in Oracle Siebel Life Sciences Enables Unauthorized Data Access
Weaknesses CWE-284
CWE-79

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Siebel Life Sciences product of Oracle Siebel CRM (component: Web UI). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Life Sciences. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel Life Sciences, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel Life Sciences accessible data as well as unauthorized access to critical data or complete access to all Siebel Life Sciences accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).
First Time appeared Oracle
Oracle siebel Life Sciences
CPEs cpe:2.3:a:oracle:siebel_life_sciences:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle siebel Life Sciences
References
Metrics cvssV3_1

{'score': 8.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N'}

Subscriptions

Oracle Siebel Crm Siebel Life Sciences
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-11-03T15:20:08.296Z

Reserved: 2026-09-28T15:40:09.483Z

Link: CVE-2026-101451

cve-icon Vulnrichment

Updated: 2026-11-03T15:18:36.835Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:17:53.753

Modified: 2026-11-09T22:39:58.620

Link: CVE-2026-101451

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-03T20:00:19Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-352

    Cross-Site Request Forgery (CSRF)