{"id":"CVE-2026-101399","kind":"vulnerability","aliases":["CVE-2026-101399"],"related":[],"title":"Oracle Siebel CRM Marketing: unauthenticated SMTP request causes partial denial of service","description":"Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via SMTP to compromise Siebel Apps - Marketing.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Siebel Apps - Marketing. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).","summary":"Oracle Siebel CRM's Marketing component, versions 17.0 through 26.9, can be attacked over the network via SMTP without credentials. A successful attack causes a partial denial of service, making the Marketing application unavailable for some functions.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise","oracle-crm","siebel","vendor"],"not_affected_if":["siebel-not-deployed"],"how_to_check":"- Confirm whether Siebel CRM Marketing is deployed and which version runs, `unknown` if the sources do not say how to read it\n- Check whether the Marketing SMTP interface is reachable from the network, `unknown` if the sources do not say","fix":"- Apply the Oracle Critical Patch Update that covers Siebel CRM Marketing, `unknown` for the exact patch version the sources do not name","status":"open","published_at":"2026-10-20T22:17:47+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T04:24:32+00:00","updated_at":"2026-10-25T04:24:32+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T04:24:32Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update that covers Siebel CRM Marketing, `unknown` for the exact patch version the sources do not name","reach":"network","title":"Oracle Siebel CRM Marketing: unauthenticated SMTP request causes partial denial of service","impact":"low","summary":"Oracle Siebel CRM's Marketing component, versions 17.0 through 26.9, can be attacked over the network via SMTP without credentials. A successful attack causes a partial denial of service, making the Marketing application unavailable for some functions.","category":"vendor","nicknames":[],"who_cares":["siebel","oracle-crm","enterprise"],"confidence":0.6,"needs_auth":"no","worst_case":"Partial denial of service of the Siebel Marketing application","analyst_note":"Check Oracle's Siebel CRM security advisory for the patched version and whether SMTP reachability is required by default.","how_to_check":"- Confirm whether Siebel CRM Marketing is deployed and which version runs, `unknown` if the sources do not say how to read it\n- Check whether the Marketing SMTP interface is reachable from the network, `unknown` if the sources do not say","needs_analyst":true,"not_affected_if":["siebel-not-deployed"],"who_is_affected":"Organizations running Oracle Siebel CRM Marketing in the affected version range where the SMTP path is reachable over the network. The sources do not describe the exact configuration needed, so teams that do not run Siebel Marketing can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000629,"input_tokens":3466,"output_tokens":564,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101399':15A,18A '-2026':14A,17A '-26.9':82C '/av':133C '17.0':32B,81C '26.9':34B '3.1':123C,132C '5.3':126C 'abil':108C 'access':91C 'affect':79C 'allow':86C 'app':66C,97C,120C 'applic':57B 'attack':37B,47B,88C,100C 'avail':127C 'base':124C 'caus':8A,48B,110C 'compon':30B,73C 'compromis':95C 'credenti':44B 'crm':3A,22B,27B,72C 'cve':13A,16A 'cvss':122C,129C,131C 'denial':10A,51B,113C 'dos':117C 'easili':83C 'enterpris':19B 'exploit':84C 'function':61B 'impact':128C 'l':141C 'l/pr':135C 'make':54B 'market':4A,29B,56B,67C,74C,98C,121C 'n/a':140C 'n/ac':134C 'n/i':139C 'n/s':137C 'n/ui':136C 'network':40B,90C 'oracl':1A,21B,25B,70C 'oracle-crm':20B 'partial':9A,50B,112C,116C 'product':68C 'request':7A 'result':105C 'score':125C 'servic':12A,53B,115C 'siebel':2A,23B,26B,65C,71C,96C,119C 'smtp':6A,42B,93C 'success':46B,99C 'support':75C 'u/c':138C 'unauthent':5A,87C 'unauthor':107C 'unavail':58B 'vector':130C 'vendor':24B 'version':31B,76C 'via':41B,92C 'vulner':62C,85C,103C 'without':43B","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle Siebel CRM Marketing in the affected version range where the SMTP path is reachable over the network. The sources do not describe the exact configuration needed, so teams that do not run Siebel Marketing can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101399","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101399","severity":null,"published_at":"2026-10-20T22:17:47+00:00","modified_at":"2026-10-22T19:17:33+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}