{"id":"CVE-2026-101439","kind":"vulnerability","aliases":["CVE-2026-101439"],"related":[],"title":"Oracle Siebel CRM Cloud: unauthenticated LDAP access exposes CRM data","description":"Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).  Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via LDAP to compromise Siebel CRM Cloud Applications.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).","summary":"A flaw in the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications lets an unauthenticated attacker on the network reach the service through LDAP. Successful exploitation can give unauthorized access to critical CRM data, per the NVD description.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ldap","oracle","siebel-crm","vendor"],"not_affected_if":["not-siebel-crm-cloud"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-20T22:17:52+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T04:08:36+00:00","updated_at":"2026-10-25T04:08:36+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T04:08:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle Siebel CRM Cloud: unauthenticated LDAP access exposes CRM data","impact":"medium","summary":"A flaw in the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications lets an unauthenticated attacker on the network reach the service through LDAP. Successful exploitation can give unauthorized access to critical CRM data, per the NVD description.","category":"vendor","nicknames":[],"who_cares":["siebel-crm","oracle","ldap"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthorized read access to critical CRM data","analyst_note":"Check Oracle's Siebel CPU advisory or the NVD page for patch versions and whether the LDAP path is on by default.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["not-siebel-crm-cloud"],"who_is_affected":"The description lists Siebel CRM Cloud Applications supported versions 22.3 through 26.9 as affected. Oracle hosts this product, so the sources do not say what a customer running it needs to change. Teams that do not run Siebel CRM Cloud Applications can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000582,"input_tokens":3488,"output_tokens":467,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101439':13A,16A '-2026':12A,15A '-26.9':86C '/av':140C '22.3':85C '3.1':130C,139C '5.9':133C 'access':7A,54B,96C,114C,120C,127C 'affect':83C 'allow':91C 'applic':36B,69C,104C,126C 'attack':40B,93C,106C 'base':131C 'cloud':4A,28B,35B,68C,77C,103C,125C 'complet':119C 'compon':30B,75C 'compromis':100C 'confidenti':134C 'critic':56B,116C 'crm':3A,9A,21B,34B,57B,67C,74C,102C,124C 'cve':11A,14A 'cvss':129C,136C,138C 'data':10A,58B,117C,128C 'descript':62B 'difficult':87C 'exploit':50B,89C 'expos':8A 'flaw':24B 'give':52B 'h/i':146C 'h/pr':142C 'impact':135C 'ldap':6A,17B,48B,98C 'let':37B 'manag':29B,78C 'n':148C 'n/a':147C 'n/ac':141C 'n/s':144C 'n/ui':143C 'network':43B,95C 'nvd':61B 'oracl':1A,18B,32B,72C 'per':59B 'product':70C 'reach':44B 'result':111C 'score':132C 'servic':46B 'siebel':2A,20B,27B,33B,66C,73C,76C,101C,123C 'siebel-crm':19B 'success':49B,105C 'support':79C 'u/c':145C 'unauthent':5A,39B,92C 'unauthor':53B,113C 'vector':137C 'vendor':22B 'version':80C 'via':97C 'vulner':63C,90C,109C","nicknames":[],"mitigations":[],"who_affected":"The description lists Siebel CRM Cloud Applications supported versions 22.3 through 26.9 as affected. Oracle hosts this product, so the sources do not say what a customer running it needs to change. Teams that do not run Siebel CRM Cloud Applications can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101439","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101439","severity":null,"published_at":"2026-10-20T22:17:52+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}