{"id":"CVE-2026-101438","kind":"vulnerability","aliases":["CVE-2026-101438"],"related":[],"title":"Oracle Siebel CRM Cloud: adjacent-network flaw lets unauthenticated attacker alter data","description":"Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).  Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications.  While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Cloud Applications accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 8.0 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).","summary":"Oracle Siebel CRM Cloud Applications has a flaw in its Siebel Cloud Manager component, affecting supported versions 22.3 through 26.9. An unauthenticated attacker on the physical communication segment attached to the hardware can gain unauthorized creation, deletion or modification of critical data and access to all data the application can reach.","severity":"high","cvss":8.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["oracle","siebel-crm","vendor"],"not_affected_if":["no-adjacent-network-access"],"how_to_check":"- Confirm whether the Siebel CRM Cloud Applications version in use falls within 22.3 through 26.9\n- Check whether any part of the hardware running the application sits on a network segment reachable by untrusted parties (unknown from the sources beyond this)","fix":"- unknown","status":"open","published_at":"2026-10-20T22:17:52+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T03:08:04+00:00","updated_at":"2026-10-25T03:08:04+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-25T03:08:04Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Oracle Siebel CRM Cloud: adjacent-network flaw lets unauthenticated attacker alter data","impact":"high","summary":"Oracle Siebel CRM Cloud Applications has a flaw in its Siebel Cloud Manager component, affecting supported versions 22.3 through 26.9. An unauthenticated attacker on the physical communication segment attached to the hardware can gain unauthorized creation, deletion or modification of critical data and access to all data the application can reach.","category":"vendor","nicknames":[],"who_cares":["siebel-crm","oracle"],"confidence":0.7,"needs_auth":"no","worst_case":"unauthorized modification or deletion of critical CRM data","analyst_note":"","how_to_check":"- Confirm whether the Siebel CRM Cloud Applications version in use falls within 22.3 through 26.9\n- Check whether any part of the hardware running the application sits on a network segment reachable by untrusted parties (unknown from the sources beyond this)","needs_analyst":false,"not_affected_if":["no-adjacent-network-access"],"who_is_affected":"Deployments of Siebel CRM Cloud Applications in versions 22.3 through 26.9 are in scope. Exposure depends on an attacker having access to the physical communication segment attached to the hardware, so the risk is highest where that segment is shared or poorly isolated. The sources do not say how this applies to Oracle-managed hosting versus customer-operated hardware.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.001119,"input_tokens":3604,"output_tokens":1517,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101438':16A,19A '-2026':15A,18A '-26.9':99C '/av':205C '22.3':42B,98C '26.9':44B '3.1':193C,204C '8.0':196C 'a/ac':206C 'access':68B,108C,161C,171C,177C,183C,190C 'addit':144C 'adjac':6A 'adjacent-network':5A 'affect':39B,96C 'allow':104C 'alter':12A 'applic':29B,73B,82C,123C,130C,139C,170C,189C 'attach':53B,114C 'attack':11A,47B,106C,140C,149C 'base':194C 'c/c':210C 'chang':147C 'cloud':4A,28B,36B,81C,90C,122C,129C,138C,169C,188C 'communic':51B,112C 'complet':182C 'compon':38B,88C 'compromis':126C 'confidenti':197C 'creation':60B,157C 'critic':65B,163C,179C 'crm':3A,23B,27B,80C,87C,121C,128C,137C,168C,187C 'cve':14A,17A 'cvss':192C,201C,203C 'data':13A,66B,71B,164C,172C,180C,191C 'delet':61B,158C 'difficult':100C 'execut':124C 'exploit':102C 'flaw':8A,32B 'gain':58B 'h/a':212C 'h/i':211C 'h/pr':207C 'hardwar':56B,117C 'impact':143C,200C 'integr':199C 'let':9A 'manag':37B,91C 'may':141C 'modif':63B,160C 'n':213C 'n/s':209C 'n/ui':208C 'network':7A 'oracl':1A,20B,25B,85C 'physic':50B,111C 'product':83C,145C 'reach':75B 'result':154C 'scope':146C 'score':195C 'segment':52B,113C 'siebel':2A,22B,26B,35B,79C,86C,89C,120C,127C,136C,167C,186C 'siebel-crm':21B 'signific':142C 'success':148C 'support':40B,92C 'unauthent':10A,46B,105C 'unauthor':59B,156C,176C 'vector':202C 'vendor':24B 'version':41B,93C 'vulner':76C,103C,133C,152C 'well':174C","nicknames":[],"mitigations":[],"who_affected":"Deployments of Siebel CRM Cloud Applications in versions 22.3 through 26.9 are in scope. Exposure depends on an attacker having access to the physical communication segment attached to the hardware, so the risk is highest where that segment is shared or poorly isolated. The sources do not say how this applies to Oracle-managed hosting versus customer-operated hardware.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101438","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101438","severity":null,"published_at":"2026-10-20T22:17:52+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}