{"id":"CVE-2026-101395","kind":"vulnerability","aliases":["CVE-2026-101395"],"related":[],"title":"Oracle Siebel CRM Marketing: unauthenticated HTTP flaw exposes and alters some data","description":"Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel Apps - Marketing, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel Apps - Marketing accessible data as well as  unauthorized read access to a subset of Siebel Apps - Marketing accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).","summary":"Oracle Siebel CRM's Marketing component has a flaw that lets an unauthenticated attacker over HTTP read and modify a subset of accessible data, but only if a user is tricked into interacting with a crafted request. The CVSS scope change means it could also affect other products beyond Siebel Marketing.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise-crm","oracle","package","siebel-crm"],"not_affected_if":["unknown"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-20T22:17:47+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T04:03:58+00:00","updated_at":"2026-10-25T04:03:58+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:03:58Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Oracle Siebel CRM Marketing: unauthenticated HTTP flaw exposes and alters some data","impact":"medium","summary":"Oracle Siebel CRM's Marketing component has a flaw that lets an unauthenticated attacker over HTTP read and modify a subset of accessible data, but only if a user is tricked into interacting with a crafted request. The CVSS scope change means it could also affect other products beyond Siebel Marketing.","category":"package","nicknames":[],"who_cares":["siebel-crm","oracle","enterprise-crm"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads and modifies some Siebel Marketing data via user action","analyst_note":"Check Oracle's Siebel CRM security advisory for the patched version and affected configurations; sources give only the CVSS vector and affected range.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running Oracle Siebel CRM Marketing in the affected supported version range 17.0 through 26.9 and exposing it over HTTP to the network. Sources do not say which exact patch level is fixed or which deployment configurations are required, so teams running Siebel Marketing should confirm their version against Oracle's advisory.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000608,"input_tokens":3562,"output_tokens":504,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101395':15A,18A '-2026':14A,17A '-26.9':98C '/av':194C '17.0':97C '3.1':182C,193C '6.1':185C 'access':49B,107C,157C,164C,171C,179C 'addit':140C 'affect':72B,95C 'allow':102C 'also':71B 'alter':10A 'app':82C,113C,134C,162C,177C 'attack':40B,104C,116C,126C,136C,145C 'base':183C 'beyond':75B 'c/c':199C 'chang':67B,143C 'compon':32B,89C 'compromis':111C 'confidenti':186C 'could':70B 'craft':62B 'crm':3A,21B,26B,29B,88C 'cve':13A,16A 'cvss':65B,181C,190C,192C 'data':12A,50B,165C,180C 'delet':156C 'easili':99C 'enterpris':20B 'enterprise-crm':19B 'exploit':100C 'expos':8A 'flaw':7A,35B 'http':6A,42B,109C 'human':118C 'impact':139C,189C 'insert':154C 'integr':188C 'interact':59B,119C 'l/a':201C 'l/i':200C 'l/pr':196C 'let':37B 'market':4A,31B,77B,83C,90C,114C,135C,163C,178C 'may':137C 'mean':68B 'modifi':45B 'n':202C 'n/ac':195C 'n/ui':197C 'network':106C 'oracl':1A,22B,27B,86C 'packag':23B 'person':122C 'product':74B,84C,141C 'r/s':198C 'read':43B,170C 'request':63B 'requir':117C 'result':150C 'scope':66B,142C 'score':184C 'siebel':2A,25B,28B,76B,81C,87C,112C,133C,161C,176C 'siebel-crm':24B 'signific':138C 'subset':47B,174C 'success':115C,144C 'support':91C 'trick':57B 'unauthent':5A,39B,103C 'unauthor':152C,169C 'updat':153C 'user':55B 'vector':191C 'version':92C 'via':108C 'vulner':78C,101C,130C,148C 'well':167C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle Siebel CRM Marketing in the affected supported version range 17.0 through 26.9 and exposing it over HTTP to the network. Sources do not say which exact patch level is fixed or which deployment configurations are required, so teams running Siebel Marketing should confirm their version against Oracle's advisory.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101395","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101395","severity":null,"published_at":"2026-10-20T22:17:47+00:00","modified_at":"2026-10-21T18:45:11+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}