CVE-2026-101406

Modified Modified - Updated After Analysis

Information Disclosure in Oracle Siebel Apps - Marketing

Publication date: 2026-10-20

Last updated on: 2026-11-06

Assigner: Oracle

Description

Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel Apps - Marketing accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-11-06

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-101406

EUVD

EUVD-2026-105822

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	siebel_crm	From 17.0 (inc) to 26.9 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability affects Oracle Siebel CRM's Siebel Apps - Marketing component versions 17.0 to 26.9. It allows an unauthenticated attacker with network access via HTTP to potentially read a subset of accessible data in the system. The attack is difficult to perform and has a low impact on confidentiality according to the CVSS score.

Detection Guidance

Detecting this vulnerability requires checking for exposed instances of Oracle Siebel Apps - Marketing versions 17.0-26.9. Inspect network traffic for HTTP requests targeting the vulnerable component. Use vulnerability scanners like Nessus or Qualys to identify affected systems. Check server logs for unusual access patterns to the Marketing component.

Impact Analysis

If exploited, this vulnerability could lead to unauthorized access to some data within the Siebel Apps - Marketing system. This may expose sensitive information, though the scope of data accessible is limited. The difficulty of exploitation reduces the risk but does not eliminate it entirely.

Compliance Impact

This vulnerability allows unauthorized read access to a subset of data in Siebel Apps - Marketing, which could potentially expose personal or sensitive information. This may impact compliance with regulations like GDPR or HIPAA if such data is involved, as unauthorized access could violate confidentiality requirements.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update for Siebel Apps - Marketing immediately. Restrict network access to the vulnerable component via firewalls or network segmentation. Disable HTTP access if possible and enforce HTTPS with strong encryption. Monitor for unauthorized access attempts.

Hi! I’m here to help you understand CVE-2026-101406. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...