CVE-2026-101449

Analyzed Analyzed - Analysis Complete

Physical Access Information Disclosure in Siebel CRM Deployment

Publication date: 2026-10-20

Last updated on: 2026-11-04

Assigner: Oracle

Description

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Siebel Management Console). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows physical access to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 2.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-11-04

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-101449

EUVD

EUVD-2026-105865

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	siebel_crm	From 17.0 (inc) to 26.9 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability affects Oracle Siebel CRM Deployment versions 17.0 to 26.9. It allows an attacker with physical access to the system to read a subset of data stored in the Siebel CRM Deployment without needing special privileges or user interaction.

Detection Guidance

This vulnerability requires physical access to exploit, so detection primarily involves physical security checks. Ensure Siebel Management Console access points are secured and monitored. No specific network commands are applicable as the attack vector is physical.

Impact Analysis

If you use Oracle Siebel CRM Deployment versions 17.0 to 26.9, an attacker with physical access to the system could potentially access sensitive data stored within the deployment. The impact is limited to unauthorized read access to a subset of data.

Compliance Impact

This vulnerability allows unauthorized read access to a subset of Siebel CRM Deployment data, which could potentially expose sensitive personal or health information. This may impact compliance with GDPR or HIPAA if such data is involved, as unauthorized access violates confidentiality requirements under these regulations.

Mitigation Strategies

Restrict physical access to systems running Siebel CRM Deployment. Ensure only authorized personnel can access deployment areas. Review and enforce strict physical security policies for affected versions (17.0-26.9).

Hi! I’m here to help you understand CVE-2026-101449. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...