Description
Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: REST). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel CRM Integration accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).
Published: 2026-10-20
Score: 3.1 Low
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Assess Impact
AI Analysis

Impact

A flaw in the REST component of Oracle Siebel CRM Integration enables an attacker with unauthenticated network access via HTTP to read a portion of integration data if the attacker can obtain a human user’s interaction, such as clicking a malicious link. The vulnerability does not lead to code execution or denial of service, but it allows unauthorized read access to data exposed through the integration endpoint.

Affected Systems

Oracle Siebel CRM Integration is affected for all versions from 17.0 to 26.9. The issue is tied to the REST layer of the product.

Risk and Exploitability

The CVSS base score is 3.1, reflecting a low but present confidentiality impact. Exploitation is difficult and requires a user other than the attacker to interact with a malicious link, which limits the likelihood of success. The EPSS score is not reported and the vulnerability is not listed in the CISA KEV catalog, indicating a low overall risk profile. Nonetheless, the ability to read sensitive data warrants proactive mitigation.

Generated by OpenCVE AI on October 21, 2026 at 07:09 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle patch released in the Oct 2026 CPU advisory for Siebel CRM Integration.
  • Limit external network access to the REST endpoint by configuring firewall rules to allow only trusted hosts.
  • Disable the REST API service on installations that do not need it, or enforce strict authentication controls for all users.

Generated by OpenCVE AI on October 21, 2026 at 07:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 04 Nov 2026 17:30:00 +0000

Type Values Removed Values Added
First Time appeared Oracle siebel Crm
CPEs cpe:2.3:a:oracle:siebel_crm:*:*:*:*:*:*:*:*
Vendors & Products Oracle siebel Crm

Wed, 28 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 07:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Read Access Vulnerability in Siebel CRM Integration REST API
Weaknesses CWE-200

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: REST). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel CRM Integration accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle siebel Crm Integration
CPEs cpe:2.3:a:oracle:siebel_crm_integration:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle siebel Crm Integration
References
Metrics cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Siebel Crm Siebel Crm Integration
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T13:03:21.771Z

Reserved: 2026-09-08T21:49:12.412Z

Link: CVE-2026-87339

cve-icon Vulnrichment

Updated: 2026-10-28T13:03:04.475Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:11.567

Modified: 2026-11-04T17:19:22.330

Link: CVE-2026-87339

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T19:00:16Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor