{"id":"CVE-2026-101405","kind":"vulnerability","aliases":["CVE-2026-101405"],"related":[],"title":"Oracle Siebel CRM Marketing: unauthenticated HTTPS flaw allows limited data read and change","description":"Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Siebel Apps - Marketing.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel Apps - Marketing accessible data as well as  unauthorized read access to a subset of Siebel Apps - Marketing accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).","summary":"Oracle Siebel CRM's Marketing component, versions 17.0 to 26.9, has a flaw that an unauthenticated attacker with network access can reach over HTTPS. Successful exploitation allows some data to be read and some data to be updated, inserted or deleted, but the sources report no full takeover.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["crm","marketing","oracle","siebel","vendor"],"not_affected_if":["not-running-siebel-marketing","version-outside-17.0-26.9"],"how_to_check":"- Confirm whether Siebel CRM Marketing is deployed and which version is running, against the affected range `17.0` to `26.9`\n- Check the Oracle Critical Patch Update advisory for the Siebel patch that covers this CVE (the sources do not name it: unknown)","fix":"- Apply the Oracle Siebel CRM security patch for this CVE (the patched version is unknown from the sources)\n- Restrict network access to the Siebel Marketing HTTPS endpoints until the patch is applied","status":"open","published_at":"2026-10-20T22:17:48+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T04:33:21+00:00","updated_at":"2026-10-25T04:33:21+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T04:33:21Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Siebel CRM security patch for this CVE (the patched version is unknown from the sources)\n- Restrict network access to the Siebel Marketing HTTPS endpoints until the patch is applied","reach":"network","title":"Oracle Siebel CRM Marketing: unauthenticated HTTPS flaw allows limited data read and change","impact":"medium","summary":"Oracle Siebel CRM's Marketing component, versions 17.0 to 26.9, has a flaw that an unauthenticated attacker with network access can reach over HTTPS. Successful exploitation allows some data to be read and some data to be updated, inserted or deleted, but the sources report no full takeover.","category":"vendor","nicknames":[],"who_cares":["siebel","oracle","crm","marketing"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads and modifies some CRM marketing data without logging in","analyst_note":"Find the Oracle Critical Patch Update advisory and the patched Siebel Marketing version; the NVD record gives no fix version.","how_to_check":"- Confirm whether Siebel CRM Marketing is deployed and which version is running, against the affected range `17.0` to `26.9`\n- Check the Oracle Critical Patch Update advisory for the Siebel patch that covers this CVE (the sources do not name it: unknown)","needs_analyst":true,"not_affected_if":["not-running-siebel-marketing","version-outside-17.0-26.9"],"who_is_affected":"Organizations running Oracle Siebel CRM Marketing within the affected version range that expose its HTTPS endpoints to a network the attacker can reach. The sources do not say whether internal-only deployments are exposed, so the network reach needs confirming. Teams not running Siebel CRM Marketing can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000686,"input_tokens":3504,"output_tokens":672,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101405':16A,19A '-2026':15A,18A '-26.9':93C '/av':161C '17.0':32B,92C '26.9':34B '3.1':149C,160C '4.8':152C 'access':44B,103C,124C,131C,138C,146C 'affect':90C 'allow':8A,51B,98C 'app':77C,109C,129C,144C 'attack':41B,100C,112C 'base':150C 'chang':13A 'compon':30B,84C 'compromis':107C 'confidenti':153C 'crm':3A,20B,27B,83C 'cve':14A,17A 'cvss':148C,157C,159C 'data':10A,53B,59B,132C,147C 'delet':65B,123C 'difficult':94C 'exploit':50B,96C 'flaw':7A,37B 'full':71B 'h/pr':163C 'https':6A,48B,105C 'impact':156C 'insert':63B,121C 'integr':155C 'l/a':168C 'l/i':167C 'limit':9A 'market':4A,21B,29B,78C,85C,110C,130C,145C 'n':169C 'n/ac':162C 'n/s':165C 'n/ui':164C 'network':43B,102C 'oracl':1A,22B,25B,81C 'product':79C 'reach':46B 'read':11A,56B,137C 'report':69B 'result':117C 'score':151C 'siebel':2A,23B,26B,76C,82C,108C,128C,143C 'sourc':68B 'subset':141C 'success':49B,111C 'support':86C 'takeov':72B 'u/c':166C 'unauthent':5A,40B,99C 'unauthor':119C,136C 'updat':62B,120C 'vector':158C 'vendor':24B 'version':31B,87C 'via':104C 'vulner':73C,97C,115C 'well':134C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle Siebel CRM Marketing within the affected version range that expose its HTTPS endpoints to a network the attacker can reach. The sources do not say whether internal-only deployments are exposed, so the network reach needs confirming. Teams not running Siebel CRM Marketing can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101405","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101405","severity":null,"published_at":"2026-10-20T22:17:48+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}