CVE-2026-87338

Analyzed Analyzed - Analysis Complete

Unauthenticated Access in Oracle Siebel CRM Integration

Publication date: 2026-10-20

Last updated on: 2026-11-04

Assigner: Oracle

Description

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel CRM Integration, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM Integration accessible data as well as unauthorized update, insert or delete access to some of Siebel CRM Integration accessible data. CVSS 3.1 Base Score 6.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-11-04

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-87338

EUVD

EUVD-2026-106380

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	siebel_crm	From 17.0 (inc) to 26.9 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Siebel CRM Integration (EAI component) affecting versions 17.0-26.9. It allows an unauthenticated attacker with network access via HTTP to potentially compromise the system. Exploitation requires human interaction from a victim and may impact other products. Successful attacks can lead to unauthorized access to critical data or full access to all accessible data in Siebel CRM Integration, as well as unauthorized data modification.

Detection Guidance

Detection of this vulnerability requires monitoring network traffic for unusual HTTP requests targeting the Siebel CRM Integration component. Check Oracle Siebel logs for unauthorized access attempts or data modifications. Ensure all HTTP traffic to Siebel CRM Integration endpoints is logged and reviewed for anomalies.

Impact Analysis

If exploited, this vulnerability could allow attackers to access sensitive data stored in Siebel CRM Integration or modify existing data. Since attacks may impact additional products, the scope of compromise could extend beyond the initial target. The need for human interaction means attackers may trick users into triggering the exploit.

Compliance Impact

This vulnerability allows unauthorized access to critical data or complete access to all accessible data in Siebel CRM Integration, which could lead to exposure of sensitive personal or health information. This may violate GDPR (data protection) and HIPAA (health data privacy) compliance if such data is compromised.

Mitigation Strategies

Apply the latest security patches from Oracle for Siebel CRM Integration versions 17.0-26.9. Restrict network access to the HTTP interface of Siebel CRM Integration. Monitor for unusual activity or unauthorized access attempts.

Hi! I’m here to help you understand CVE-2026-87338. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...