{"id":"CVE-2026-101406","kind":"vulnerability","aliases":["CVE-2026-101406"],"related":[],"title":"Oracle Siebel Marketing: unauthenticated read of a subset of data","description":"Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Siebel Apps - Marketing accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).","summary":"Oracle Siebel CRM's Marketing module, versions 17.0 through 26.9, has a flaw reachable over HTTP without a login. A hard-to-exploit attack can read a subset of the data the module holds.","severity":"low","cvss":3.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["on-prem","oracle-crm","siebel","vendor"],"not_affected_if":["siebel-marketing-not-installed"],"how_to_check":"- Check the installed Siebel Apps - Marketing version against the affected range 17.0-26.9 in the Oracle Critical Patch Update advisory\n- unknown for other checks: the sources do not say which configuration or endpoint is exposed","fix":"- Apply the Oracle Critical Patch Update for Siebel CRM that covers Siebel Apps - Marketing; the sources do not name the fixed version\n- unknown for interim mitigations: the sources do not say","status":"open","published_at":"2026-10-20T22:17:48+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T04:44:00+00:00","updated_at":"2026-10-25T04:44:00+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T04:44:00Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update for Siebel CRM that covers Siebel Apps - Marketing; the sources do not name the fixed version\n- unknown for interim mitigations: the sources do not say","reach":"network","title":"Oracle Siebel Marketing: unauthenticated read of a subset of data","impact":"low","summary":"Oracle Siebel CRM's Marketing module, versions 17.0 through 26.9, has a flaw reachable over HTTP without a login. A hard-to-exploit attack can read a subset of the data the module holds.","category":"vendor","nicknames":[],"who_cares":["siebel","oracle-crm","on-prem"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads a subset of Siebel Marketing data","analyst_note":"Confirm the fixed Siebel Marketing version and mitigation steps in the Oracle CPU advisory; the NVD entry has no fix details.","how_to_check":"- Check the installed Siebel Apps - Marketing version against the affected range 17.0-26.9 in the Oracle Critical Patch Update advisory\n- unknown for other checks: the sources do not say which configuration or endpoint is exposed","needs_analyst":true,"not_affected_if":["siebel-marketing-not-installed"],"who_is_affected":"Organizations running Oracle Siebel CRM Marketing in versions 17.0 through 26.9 with the Marketing component reachable over HTTP from the network. The sources do not say which deployment settings make the component reachable, so teams should confirm exposure of their Siebel web tier. Teams not running Siebel CRM Marketing can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000655,"input_tokens":3461,"output_tokens":617,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-101406':13A,16A '-2026':12A,15A '-26.9':80C '/av':129C '17.0':32B,79C '26.9':34B '3.1':119C,128C '3.7':122C 'access':90C,108C,116C 'affect':77C 'allow':85C 'app':64C,96C,114C 'attack':49B,87C,99C 'base':120C 'compon':71C 'compromis':94C 'confidenti':123C 'crm':22B,27B,70C 'cve':11A,14A 'cvss':118C,125C,127C 'data':10A,56B,117C 'difficult':81C 'exploit':48B,83C 'flaw':37B 'h/pr':131C 'hard':46B 'hard-to-exploit':45B 'hold':59B 'http':40B,92C 'impact':124C 'l/i':135C 'login':43B 'market':3A,29B,65C,72C,97C,115C 'modul':30B,58B 'n':137C 'n/a':136C 'n/ac':130C 'n/s':133C 'n/ui':132C 'network':89C 'on-prem':17B 'oracl':1A,21B,25B,68C 'oracle-crm':20B 'prem':19B 'product':66C 'reachabl':38B 'read':5A,51B,107C 'result':104C 'score':121C 'siebel':2A,23B,26B,63C,69C,95C,113C 'subset':8A,53B,111C 'success':98C 'support':73C 'u/c':134C 'unauthent':4A,86C 'unauthor':106C 'vector':126C 'vendor':24B 'version':31B,74C 'via':91C 'vulner':60C,84C,102C 'without':41B","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle Siebel CRM Marketing in versions 17.0 through 26.9 with the Marketing component reachable over HTTP from the network. The sources do not say which deployment settings make the component reachable, so teams should confirm exposure of their Siebel web tier. Teams not running Siebel CRM Marketing can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101406","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101406","severity":null,"published_at":"2026-10-20T22:17:48+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}