---
id: "CVE-2026-101405"
kind: "vulnerability"
aliases: ["CVE-2026-101405"]
title: "Oracle Siebel CRM Marketing: unauthenticated HTTPS flaw allows limited data read and change"
severity: "medium"
cvss: 4.8
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["crm", "marketing", "oracle", "siebel", "vendor"]
not_affected_if: ["not-running-siebel-marketing", "version-outside-17.0-26.9"]
published_at: "2026-10-20T22:17:48+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-25T04:33:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101405", "first_seen_at": "2026-10-23T21:57:21+00:00"}]
---

# Oracle Siebel CRM Marketing: unauthenticated HTTPS flaw allows limited data read and change

Oracle Siebel CRM's Marketing component, versions 17.0 to 26.9, has a flaw that an unauthenticated attacker with network access can reach over HTTPS. Successful exploitation allows some data to be read and some data to be updated, inserted or deleted, but the sources report no full takeover.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm whether Siebel CRM Marketing is deployed and which version is running, against the affected range `17.0` to `26.9`
- Check the Oracle Critical Patch Update advisory for the Siebel patch that covers this CVE (the sources do not name it: unknown)

## Fix

- Apply the Oracle Siebel CRM security patch for this CVE (the patched version is unknown from the sources)
- Restrict network access to the Siebel Marketing HTTPS endpoints until the patch is applied

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101405

## From the sources

Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Siebel Apps - Marketing.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel Apps - Marketing accessible data as well as  unauthorized read access to a subset of Siebel Apps - Marketing accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_