Description
Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Configuration Tools). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Development executes to compromise Siebel CRM Development. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM Development accessible data as well as unauthorized read access to a subset of Siebel CRM Development accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).
Published: 2026-10-20
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Modification
Action: Patch
AI Analysis

Impact

The vulnerability resides within the Configuration Tools component of Oracle Siebel CRM Development. A low‑privileged attacker who can logon to the infrastructure where the product runs can exploit this flaw to create, delete, or modify data. The impact includes unauthorized alteration of critical data, potential loss of data integrity, and the ability to read restricted subsets of data. The weakness is rooted in improper access control.

Affected Systems

Affected products are Oracle Siebel CRM Development versions 17.0 through 26.9. The vulnerability applies broadly to all installations of these versions until the issue is remedied.

Risk and Exploitability

The CVSS v3.1 score is 6.1, signaling moderate severity with significant impact on confidentiality and integrity but no denial of service. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog. Attackers would need local or trusted access to the system; once logged in, the flaw is readily exploitable without additional privileges.

Generated by OpenCVE AI on October 20, 2026 at 23:50 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Oracle Siebel CRM Development to a version above 26.9 or apply the vendor patch that fixes the configuration tool vulnerability.
  • Restrict logon access to the infrastructure hosting Siebel CRM Development to only authorized and highly privileged users.
  • Implement monitoring and audit trails to detect unauthorized data creation, modification, or deletion activities.

Generated by OpenCVE AI on October 20, 2026 at 23:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 10 Nov 2026 00:15:00 +0000

Type Values Removed Values Added
First Time appeared Oracle siebel Crm
CPEs cpe:2.3:a:oracle:siebel_crm:*:*:*:*:*:*:*:*
Vendors & Products Oracle siebel Crm

Tue, 03 Nov 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification in Oracle Siebel CRM Development's Configuration Tools
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Configuration Tools). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Development executes to compromise Siebel CRM Development. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM Development accessible data as well as unauthorized read access to a subset of Siebel CRM Development accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).
First Time appeared Oracle
Oracle siebel Crm Development
CPEs cpe:2.3:a:oracle:siebel_crm_development:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle siebel Crm Development
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N'}

Subscriptions

Oracle Siebel Crm Siebel Crm Development
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-11-03T15:56:41.607Z

Reserved: 2026-09-28T15:40:09.483Z

Link: CVE-2026-101454

cve-icon Vulnrichment

Updated: 2026-11-03T15:56:05.219Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:17:54.103

Modified: 2026-11-09T22:43:25.050

Link: CVE-2026-101454

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T00:30:08Z

Weaknesses