CVE-2026-101397

Analyzed Analyzed - Analysis Complete

Information Disclosure in Oracle Siebel Apps - Marketing

Publication date: 2026-10-20

Last updated on: 2026-11-06

Assigner: Oracle

Description

Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Siebel Apps - Marketing. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel Apps - Marketing accessible data. CVSS 3.1 Base Score 2.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-11-06

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-101397

EUVD

EUVD-2026-105813

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	siebel_crm	From 17.0 (inc) to 26.9 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Siebel CRM's Siebel Apps - Marketing product affecting versions 17.0 to 26.9. It allows a highly privileged attacker with network access via HTTP to potentially read a subset of accessible data in the marketing application. The attack is difficult to exploit and has a low impact on confidentiality.

Detection Guidance

This vulnerability is difficult to exploit and requires high privileges and network access. Detection may involve monitoring HTTP traffic for unusual access patterns or unauthorized data requests. Check Oracle Siebel CRM logs for suspicious activities related to the Marketing component.

Impact Analysis

If exploited, this vulnerability could lead to unauthorized access to sensitive marketing data. However, the attack requires high privileges and is difficult to execute, reducing the risk of real-world impact.

Compliance Impact

This vulnerability allows unauthorized read access to a subset of data, which could potentially expose personal or sensitive information. This may impact compliance with GDPR (if personal data is involved) or HIPAA (if protected health information is accessed), depending on the data processed by the Siebel Apps - Marketing system.

Mitigation Strategies

Apply the latest security patches from Oracle for Siebel Apps - Marketing versions 17.0-26.9. Restrict network access to the HTTP interface to trusted sources only. Monitor for unusual data access patterns in the Marketing component.

Hi! I’m here to help you understand CVE-2026-101397. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...