CVE-2026-101476

Modified Modified - Updated After Analysis

Unauthenticated Data Manipulation in Siebel Apps Marketing

Publication date: 2026-10-20

Last updated on: 2026-11-06

Assigner: Oracle

Description

Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel Apps - Marketing accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-11-06

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-101476

EUVD

EUVD-2026-105892

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	siebel_crm	From 17.0 (inc) to 26.9 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability affects Oracle Siebel CRM's Siebel Apps - Marketing product versions 17.0 to 26.9. It allows an unauthenticated attacker with network access via HTTP to potentially modify data in the application if a user interacts with a malicious request. The impact is limited to data integrity, with no confidentiality or availability loss.

Detection Guidance

This vulnerability requires human interaction and affects Oracle Siebel Apps - Marketing versions 17.0-26.9. Detection may involve checking for unauthorized data modifications in the Marketing component via HTTP access logs or application monitoring tools.

Impact Analysis

If exploited, this vulnerability could let an attacker change data in your Siebel Apps - Marketing system without needing credentials. This could lead to incorrect or misleading information being stored or displayed, potentially affecting business decisions or customer interactions.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized data modifications, which may violate integrity requirements in regulations like GDPR or HIPAA. If customer or sensitive data is altered without authorization, it could lead to non-compliance with data integrity and security controls.

Mitigation Strategies

Apply the latest security patches from Oracle for Siebel Apps - Marketing versions 17.0-26.9. Restrict network access to HTTP ports used by the application. Monitor for unauthorized data modifications in the Siebel Apps - Marketing database.

Hi! I’m here to help you understand CVE-2026-101476. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...