Description
Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration). Supported versions that are affected are 25.12-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM Integration accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Published: 2026-10-20
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Access
Action: Patch Now
AI Analysis

Impact

A flaw in Oracle Siebel CRM Integration's Open Integration component permits an attacker that can reach the service over HTTP to read any data accessible through the integration interface. The vulnerability, a CWE-200 information disclosure weakness, allows unauthenticated disclosure of sensitive information without affecting integrity or availability, resulting in a confidentiality breach.

Affected Systems

Oracle Corporation’s Siebel CRM Integration, versions 25.12 through 26.9, is impacted by this weakness.

Risk and Exploitability

The CVSS v3.1 base score of 7.5 indicates high severity for confidentiality, yet the EPSS score is only less than 1 %, suggesting a low probability of real‑world exploitation at present. The flaw remains unlisted in CISA’s KEV catalog. An attacker can launch the compromise from any host that can reach the integration service over HTTP, without needing authentication or special privileges.

Generated by OpenCVE AI on October 22, 2026 at 07:47 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the patch or update released in Oracle’s CPU Oct 2026 advisory for Siebel CRM Integration.
  • Limit HTTP exposure to the integration service by segmenting the network or implementing firewall or ACL rules that allow traffic only from trusted hosts.
  • Configure and enforce role‑based access controls for the Open Integration component, following Oracle’s security best‑practice guidance.

Generated by OpenCVE AI on October 22, 2026 at 07:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 22 Oct 2026 08:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Data Disclosure via HTTP in Siebel CRM Integration

Thu, 22 Oct 2026 03:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Data Disclosure via HTTP in Siebel CRM Integration

Wed, 21 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Enables Full Data Access in Siebel CRM Integration
Weaknesses CWE-284

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Enables Full Data Access in Siebel CRM Integration
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration). Supported versions that are affected are 25.12-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM Integration accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
First Time appeared Oracle
Oracle siebel Crm Integration
CPEs cpe:2.3:a:oracle:siebel_crm_integration:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle siebel Crm Integration
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Oracle Siebel Crm Integration
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-21T15:39:29.125Z

Reserved: 2026-09-14T22:10:16.631Z

Link: CVE-2026-91377

cve-icon Vulnrichment

Updated: 2026-10-21T15:39:23.128Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:40.773

Modified: 2026-10-21T18:45:11.277

Link: CVE-2026-91377

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T08:00:04Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor