Description
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Portal Framework). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Siebel CRM End User. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM End User accessible data as well as unauthorized access to critical data or complete access to all Siebel CRM End User accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-10-20
Score: 7.4 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data manipulation
Action: Immediate Patch
AI Analysis

Impact

This vulnerability is located in the Portal Framework component of Oracle Siebel CRM End User and permits an unauthenticated attacker that can reach the application over HTTPS to perform operations that create, delete, or modify critical data. The primary impact is on confidentiality and integrity, as the attacker can alter or remove information stored in the system; the vulnerability does not provide remote code execution or denial of service.

Affected Systems

The affected product is Oracle Siebel CRM End User, including all releases from version 17.0 through 26.9. The vulnerability originates in the Portal Framework component that processes HTTPS requests from external clients.

Risk and Exploitability

The CVSS 3.1 base score of 7.4 indicates a high severity, reflecting significant confidentiality and integrity impacts. EPSS is not available, and the flaw is not listed in CISA KEV. The attack requires an unauthenticated network connection to the HTTPS endpoint, and no special privileges or local access are needed to exploit the flaw.

Generated by OpenCVE AI on October 21, 2026 at 05:46 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the official patch released in Oracle’s CPU October 2026 for Siebel CRM End User 17.0‑26.9
  • Upgrade to the newest supported version of Siebel CRM End User if a patch is unavailable
  • Restrict network access to the Siebel CRM End User HTTPS endpoint using firewall rules or a VPN to limit exposure to trusted networks

Generated by OpenCVE AI on October 21, 2026 at 05:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 05 Nov 2026 13:15:00 +0000

Type Values Removed Values Added
First Time appeared Oracle siebel Crm
CPEs cpe:2.3:a:oracle:siebel_crm:*:*:*:*:*:*:*:*
Vendors & Products Oracle siebel Crm

Wed, 21 Oct 2026 06:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTPS Exploit Enables Unauthorized Data Manipulation in Siebel CRM End User
Weaknesses CWE-284
CWE-285

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Portal Framework). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Siebel CRM End User. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM End User accessible data as well as unauthorized access to critical data or complete access to all Siebel CRM End User accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle siebel Crm End User
CPEs cpe:2.3:a:oracle:siebel_crm_end_user:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle siebel Crm End User
References
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Siebel Crm Siebel Crm End User
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-21T17:34:09.616Z

Reserved: 2026-09-28T15:40:09.485Z

Link: CVE-2026-101467

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:17:55.593

Modified: 2026-11-05T13:03:38.487

Link: CVE-2026-101467

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T06:00:07Z

Weaknesses