Description
Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel CRM Integration. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-10-20
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch Deployment
AI Analysis

Impact

The vulnerability is present in the Siebel CRM Integration component of Oracle Siebel CRM and can be exploited with no authentication by sending specially crafted HTTP requests across the network. An attacker can trigger a hang or complete crash of the integration, resulting in a denial of service that affects only availability. This weakness corresponds to CWE-400 and CWE-770.

Affected Systems

Oracle Corporation’s Siebel CRM Integration, covering versions 17.0 through 26.9, is affected.

Risk and Exploitability

The CVSS v3.1 base score of 7.5 reflects a high availability impact (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The EPSS score is less than 1% and the vulnerability is not listed in CISA KEV, indicating that while it is likely exploitable given the network access and lack of authentication requirement, it has not yet been confirmed in widespread public exploit activity. Attackers can use standard web traffic to trigger the flaw.

Generated by OpenCVE AI on October 22, 2026 at 10:47 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest security update for Siebel CRM Integration from Oracle (see the October 2026 CPU advisory).
  • Restrict HTTP access to the integration functionality to trusted IP ranges or networks using firewall rules or access control lists.
  • Enable application crash logging and, if feasible, configure the integration for automatic restart or fail‑over to mitigate service disruption until a patch is applied.

Generated by OpenCVE AI on October 22, 2026 at 10:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 05 Nov 2026 13:15:00 +0000

Type Values Removed Values Added
First Time appeared Oracle siebel Crm
CPEs cpe:2.3:a:oracle:siebel_crm:*:*:*:*:*:*:*:*
Vendors & Products Oracle siebel Crm

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 11:15:00 +0000

Type Values Removed Values Added
Title HTTP-based Denial of Service via Siebel CRM Integration
Weaknesses CWE-400
CWE-770

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel CRM Integration. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle siebel Crm Integration
CPEs cpe:2.3:a:oracle:siebel_crm_integration:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle siebel Crm Integration
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Siebel Crm Siebel Crm Integration
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-22T18:50:23.096Z

Reserved: 2026-09-28T15:40:09.488Z

Link: CVE-2026-101508

cve-icon Vulnrichment

Updated: 2026-10-22T18:42:39.766Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:18:00.120

Modified: 2026-11-05T13:01:29.803

Link: CVE-2026-101508

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T11:00:06Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-770

    Allocation of Resources Without Limits or Throttling