{"id":"CVE-2026-101393","kind":"vulnerability","aliases":["CVE-2026-101393"],"related":[],"title":"Oracle Siebel CRM Marketing: unauthenticated flaw allows limited data changes","description":"Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel Apps - Marketing accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N).","summary":"Oracle Siebel CRM's Marketing component, versions 17.0 through 26.9, has a flaw that an unauthenticated network attacker can reach over HTTP. A successful attack requires a person other than the attacker to take an action, and it can change or delete some accessible data.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["oracle","self-hosted","siebel-crm","vendor"],"not_affected_if":["unknown"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-20T22:17:47+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T04:39:20+00:00","updated_at":"2026-10-25T04:39:20+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T04:39:20Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Oracle Siebel CRM Marketing: unauthenticated flaw allows limited data changes","impact":"medium","summary":"Oracle Siebel CRM's Marketing component, versions 17.0 through 26.9, has a flaw that an unauthenticated network attacker can reach over HTTP. A successful attack requires a person other than the attacker to take an action, and it can change or delete some accessible data.","category":"vendor","nicknames":[],"who_cares":["siebel-crm","oracle","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Some accessible CRM data can be modified or deleted by an attacker","analyst_note":"Check Oracle's Critical Patch Update advisory for the fixed Siebel Marketing version and the affected-version wording, since the NVD entry alone gives no fix or check.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running Oracle Siebel CRM Marketing in the affected version range, where the Marketing component is reachable over HTTP. The sources do not say which deployment settings are required. Teams not running Siebel CRM can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000582,"input_tokens":3484,"output_tokens":467,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101393':13A,16A '-2026':12A,15A '-26.9':90C '/av':152C '17.0':32B,89C '26.9':34B '3.1':142C,151C '4.3':145C 'access':68B,99C,132C,139C 'action':60B 'affect':87C 'allow':7A,94C 'app':74C,105C,137C 'attack':42B,49B,56B,96C,108C,118C,120C 'base':143C 'chang':10A,64B 'compon':30B,81C 'compromis':103C 'crm':3A,23B,27B,80C 'cve':11A,14A 'cvss':141C,148C,150C 'data':9A,69B,140C 'delet':66B,131C 'easili':91C 'exploit':92C 'flaw':6A,37B 'host':20B 'http':46B,101C 'human':110C 'impact':147C 'insert':129C 'integr':146C 'interact':111C 'l/a':159C 'l/pr':154C 'limit':8A 'market':4A,29B,75C,82C,106C,138C 'n':160C 'n/ac':153C 'n/i':158C 'n/ui':155C 'network':41B,98C 'oracl':1A,17B,25B,78C 'person':52B,114C 'product':76C 'r/s':156C 'reach':44B 'requir':50B,109C 'result':125C 'score':144C 'self':19B 'self-host':18B 'siebel':2A,22B,26B,73C,79C,104C,136C 'siebel-crm':21B 'success':48B,107C,119C 'support':83C 'take':58B 'u/c':157C 'unauthent':5A,40B,95C 'unauthor':127C 'updat':128C 'vector':149C 'vendor':24B 'version':31B,84C 'via':100C 'vulner':70C,93C,123C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle Siebel CRM Marketing in the affected version range, where the Marketing component is reachable over HTTP. The sources do not say which deployment settings are required. Teams not running Siebel CRM can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101393","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101393","severity":null,"published_at":"2026-10-20T22:17:47+00:00","modified_at":"2026-10-21T18:45:11+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}