{"id":"CVE-2026-101403","kind":"vulnerability","aliases":["CVE-2026-101403"],"related":[],"title":"Oracle Siebel Marketing: Email Marketing flaw exposes data to unauthenticated attackers","description":"Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Email Marketing).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel Apps - Marketing accessible data as well as  unauthorized update, insert or delete access to some of Siebel Apps - Marketing accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N).","summary":"Oracle Siebel Apps - Marketing's Email Marketing component has a flaw reachable over HTTP without credentials, but it is hard to exploit and needs a victim to take an action. A successful attack can read sensitive CRM data and modify or delete some of it.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["marketing","oracle","self-hosted","siebel-crm","vendor"],"not_affected_if":["not-siebel-marketing"],"how_to_check":"- Confirm whether Siebel Apps - Marketing is deployed and which version is running, against the affected range 17.0-26.9 listed in the advisory.\n- unknown for further detail on which Email Marketing endpoints are exposed.","fix":"- Apply the Oracle Siebel Critical Patch Update that covers Siebel Apps - Marketing 17.0-26.9 (patch identifier unknown from the sources).","status":"open","published_at":"2026-10-20T22:17:48+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T04:08:38+00:00","updated_at":"2026-10-25T04:08:38+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T04:08:38Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Siebel Critical Patch Update that covers Siebel Apps - Marketing 17.0-26.9 (patch identifier unknown from the sources).","reach":"internet","title":"Oracle Siebel Marketing: Email Marketing flaw exposes data to unauthenticated attackers","impact":"medium","summary":"Oracle Siebel Apps - Marketing's Email Marketing component has a flaw reachable over HTTP without credentials, but it is hard to exploit and needs a victim to take an action. A successful attack can read sensitive CRM data and modify or delete some of it.","category":"vendor","nicknames":[],"who_cares":["oracle","siebel-crm","marketing","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads and alters some CRM marketing data over HTTP","analyst_note":"Check Oracle's Siebel Critical Patch Update advisory for the patch identifier and the exact fixed version; the sources give only the affected range.","how_to_check":"- Confirm whether Siebel Apps - Marketing is deployed and which version is running, against the affected range 17.0-26.9 listed in the advisory.\n- unknown for further detail on which Email Marketing endpoints are exposed.","needs_analyst":true,"not_affected_if":["not-siebel-marketing"],"who_is_affected":"Organizations running Oracle Siebel Apps - Marketing in the 17.0 to 26.9 range with the Email Marketing component reachable over HTTP. Teams that do not run Siebel CRM Marketing can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000652,"input_tokens":3532,"output_tokens":598,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101403':14A,17A '-2026':13A,16A '-26.9':90C '/av':173C '17.0':89C '3.1':161C,172C '5.9':164C 'access':100C,129C,135C,141C,151C,158C 'action':56B 'affect':87C 'allow':95C 'app':29B,73C,106C,139C,156C 'attack':11A,59B,97C,109C,119C,121C 'base':162C 'complet':134C 'compon':34B,80C 'compromis':104C 'confidenti':165C 'credenti':42B 'critic':131C 'crm':25B,63B,79C 'cve':12A,15A 'cvss':160C,169C,171C 'data':8A,64B,132C,142C,159C 'delet':68B,150C 'difficult':91C 'email':4A,32B,81C 'exploit':48B,93C 'expos':7A 'flaw':6A,37B 'h/i':179C 'h/pr':175C 'hard':46B 'host':22B 'http':40B,102C 'human':111C 'impact':168C 'insert':148C 'integr':167C 'interact':112C 'l/a':180C 'market':3A,5A,18B,30B,33B,74C,82C,107C,140C,157C 'modifi':66B 'n':181C 'n/ac':174C 'n/ui':176C 'need':50B 'network':99C 'oracl':1A,19B,27B,77C 'person':115C 'product':75C 'r/s':177C 'reachabl':38B 'read':61B 'requir':110C 'result':126C 'score':163C 'self':21B 'self-host':20B 'sensit':62B 'siebel':2A,24B,28B,72C,78C,105C,138C,155C 'siebel-crm':23B 'success':58B,108C,120C 'support':83C 'take':54B 'u/c':178C 'unauthent':10A,96C 'unauthor':128C,146C 'updat':147C 'vector':170C 'vendor':26B 'version':84C 'via':101C 'victim':52B 'vulner':69C,94C,124C 'well':144C 'without':41B","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle Siebel Apps - Marketing in the 17.0 to 26.9 range with the Email Marketing component reachable over HTTP. Teams that do not run Siebel CRM Marketing can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101403","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101403","severity":null,"published_at":"2026-10-20T22:17:48+00:00","modified_at":"2026-10-23T03:16:31+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}