{"id":"CVE-2026-101442","kind":"vulnerability","aliases":["CVE-2026-101442"],"related":[],"title":"Oracle Siebel CRM Cloud: low-privilege users can read a subset of data","description":"Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).  Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Cloud Applications.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).","summary":"Oracle Siebel CRM Cloud Applications, through the Siebel Cloud Manager component, has a flaw that lets a low-privilege user reach data over HTTP. An attacker who succeeds can read a subset of the data the application holds, but cannot change data or take control.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["crm","oracle","siebel-crm","vendor"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-20T22:17:52+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T04:47:43+00:00","updated_at":"2026-10-25T04:47:43+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T04:47:43Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Oracle Siebel CRM Cloud: low-privilege users can read a subset of data","impact":"low","summary":"Oracle Siebel CRM Cloud Applications, through the Siebel Cloud Manager component, has a flaw that lets a low-privilege user reach data over HTTP. An attacker who succeeds can read a subset of the data the application holds, but cannot change data or take control.","category":"vendor","nicknames":[],"who_cares":["siebel-crm","oracle","crm"],"confidence":0.6,"needs_auth":"yes","worst_case":"Low-privilege attacker reads a subset of CRM data","analyst_note":"Find Oracle's Critical Patch Update advisory for this CVE to confirm fixed versions and whether the cloud service was patched by Oracle without customer action.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Affected versions are listed as Siebel CRM Cloud Applications 22.3 through 26.9 per the description. Teams that run Oracle-hosted Siebel Cloud Applications should check Oracle's advisory for patch status; the sources do not say which deployments are covered or what the fix version is.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000583,"input_tokens":3481,"output_tokens":469,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-101442':17A,20A '-2026':16A,19A '-26.9':96C '/av':148C '22.3':95C '3.1':138C,141C,147C 'access':107C,126C,135C 'affect':93C 'allow':101C 'applic':31B,64B,79C,115C,134C 'attack':53B,104C,117C 'base':139C 'cannot':67B 'chang':68B 'cloud':4A,30B,35B,78C,87C,114C,133C 'compon':37B,85C 'compromis':111C 'confidenti':142C 'control':72B 'crm':3A,21B,25B,29B,77C,84C,113C,132C 'cve':15A,18A 'cvss':137C,144C,146C 'data':14A,49B,62B,69B,136C 'difficult':97C 'exploit':99C 'flaw':40B 'h/pr':150C 'hold':65B 'http':51B,109C 'impact':143C 'l/i':154C 'l/ui':151C 'let':42B 'low':6A,45B,102C 'low-privileg':5A,44B 'manag':36B,88C 'n':156C 'n/a':155C 'n/ac':149C 'n/s':152C 'network':106C 'oracl':1A,22B,27B,82C 'privileg':7A,46B,103C 'product':80C 'reach':48B 'read':10A,57B,125C 'result':122C 'score':140C 'siebel':2A,24B,28B,34B,76C,83C,86C,112C,131C 'siebel-crm':23B 'subset':12A,59B,129C 'succeed':55B 'success':116C 'support':89C 'take':71B 'u/c':153C 'unauthor':124C 'user':8A,47B 'vector':145C 'vendor':26B 'version':90C 'via':108C 'vulner':73C,100C,120C","nicknames":[],"mitigations":[],"who_affected":"Affected versions are listed as Siebel CRM Cloud Applications 22.3 through 26.9 per the description. Teams that run Oracle-hosted Siebel Cloud Applications should check Oracle's advisory for patch status; the sources do not say which deployments are covered or what the fix version is.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101442","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101442","severity":null,"published_at":"2026-10-20T22:17:52+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}