{"id":"CVE-2026-101400","kind":"vulnerability","aliases":["CVE-2026-101400"],"related":[],"title":"Oracle Siebel Marketing: local attacker can cause partial denial of service","description":"Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Siebel Apps - Marketing executes to compromise Siebel Apps - Marketing.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Siebel Apps - Marketing. CVSS 3.1 Base Score 2.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).","summary":"Oracle Siebel CRM's Marketing component, supported versions 17.0 through 26.9, has a flaw that lets an unauthenticated attacker who already has logon to the host cause a partial denial of service. The CVSS 3.1 score is 2.9 with only availability impact.","severity":"low","cvss":2.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise-crm","oracle","siebel-crm","vendor"],"not_affected_if":["not-running-siebel"],"how_to_check":"- Check whether Siebel CRM Marketing is deployed and which version is installed, versions 17.0 to 26.9 are listed as affected\n- unknown","fix":"- Apply the Oracle Siebel CRM Marketing patch for the affected release (fixed version unknown from sources)\n- unknown","status":"open","published_at":"2026-10-20T22:17:47+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T04:47:57+00:00","updated_at":"2026-10-25T04:47:57+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-25T04:47:57Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Siebel CRM Marketing patch for the affected release (fixed version unknown from sources)\n- unknown","reach":"local","title":"Oracle Siebel Marketing: local attacker can cause partial denial of service","impact":"low","summary":"Oracle Siebel CRM's Marketing component, supported versions 17.0 through 26.9, has a flaw that lets an unauthenticated attacker who already has logon to the host cause a partial denial of service. The CVSS 3.1 score is 2.9 with only availability impact.","category":"vendor","nicknames":[],"who_cares":["oracle","siebel-crm","enterprise-crm"],"confidence":0.7,"needs_auth":"yes","worst_case":"Partial denial of service of the Siebel Marketing application","analyst_note":"Confirm the fixed version and patch advisory for Oracle Siebel CRM Marketing 17.0-26.9 from the Oracle Critical Patch Update page.","how_to_check":"- Check whether Siebel CRM Marketing is deployed and which version is installed, versions 17.0 to 26.9 are listed as affected\n- unknown","needs_analyst":true,"not_affected_if":["not-running-siebel"],"who_is_affected":"Organizations running Oracle Siebel CRM Marketing in the affected version range are listed as affected. The attacker needs local logon to the infrastructure where Siebel Marketing runs, so exposure is limited to that host and its logged-in users. Teams not running Siebel CRM can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000634,"input_tokens":3483,"output_tokens":571,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-101400':14A,17A '-2026':13A,16A '-26.9':88C '/av':145C '17.0':34B,87C '2.9':63B,138C '26.9':36B '3.1':60B,135C,144C 'abil':120C 'affect':85C 'allow':93C 'alreadi':46B 'app':72C,103C,109C,132C 'attack':5A,44B,95C,112C 'avail':66B,139C 'base':136C 'caus':7A,52B,122C 'compon':31B,79C 'compromis':107C 'crm':20B,24B,28B,78C 'cve':12A,15A 'cvss':59B,134C,141C,143C 'denial':9A,55B,125C 'difficult':89C 'dos':129C 'enterpris':19B 'enterprise-crm':18B 'execut':105C 'exploit':91C 'flaw':39B 'h/pr':147C 'host':51B 'impact':67B,140C 'infrastructur':100C 'l':153C 'l/ac':146C 'let':41B 'local':4A 'logon':48B,97C 'market':3A,30B,73C,80C,104C,110C,133C 'n/a':152C 'n/i':151C 'n/s':149C 'n/ui':148C 'oracl':1A,21B,26B,76C 'partial':8A,54B,124C,128C 'product':74C 'result':117C 'score':61B,137C 'servic':11A,57B,127C 'siebel':2A,23B,27B,71C,77C,102C,108C,131C 'siebel-crm':22B 'success':111C 'support':32B,81C 'u/c':150C 'unauthent':43B,94C 'unauthor':119C 'vector':142C 'vendor':25B 'version':33B,82C 'vulner':68C,92C,115C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle Siebel CRM Marketing in the affected version range are listed as affected. The attacker needs local logon to the infrastructure where Siebel Marketing runs, so exposure is limited to that host and its logged-in users. Teams not running Siebel CRM can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101400","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101400","severity":null,"published_at":"2026-10-20T22:17:47+00:00","modified_at":"2026-10-23T03:16:30+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}