{"id":"CVE-2026-101446","kind":"vulnerability","aliases":["CVE-2026-101446"],"related":[],"title":"Oracle Siebel CRM Cloud: low-privilege HTTP attacker takes over the service","description":"Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Cloud Applications.  While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Siebel CRM Cloud Applications. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","summary":"Oracle Siebel CRM Cloud Applications (component Siebel Cloud Manager), versions 17.0 through 26.9, has a flaw that lets a low-privilege attacker with HTTP network access take over the application and affect other products (scope change). CVSS 3.1 9.9, fixed in Oracle's October 2026 Critical Patch Update. No known exploitation or public PoC.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Siebel CRM Cloud Applications","fixed":["see Oracle CPU Oct 2026 (26.10 per Armis, unconfirmed)"],"affected":">= 17.0, <= 26.9","ecosystem":"vendor"}],"ecosystems":[],"tags":["cloud-applications","oracle","self-hosted","siebel-crm","vendor"],"not_affected_if":["managed-hosting","no-siebel-cloud-tenant"],"how_to_check":"Check your Siebel CRM Cloud Applications version: 17.0 through 26.9 is affected. Check whether the Siebel Cloud Manager HTTP interface is reachable from untrusted networks, and list which low-privilege accounts can reach it. Check whether the October 2026 CPU patch is applied in Oracle Support.","fix":"Apply the Siebel CRM patch from Oracle's October 2026 CPU via Oracle Support (support.oracle.com). Armis says the fixed version is 26.10 or later, but Oracle's own page was not confirmed. Until patched, restrict HTTP access to Siebel Cloud Manager to trusted admin networks and audit low-privilege accounts.","status":"open","published_at":"2026-10-20T22:17:53+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-23T22:38:58+00:00","updated_at":"2026-10-23T23:10:31+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T22:38:58Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Oracle Siebel CRM Cloud: low-privilege HTTP attacker takes over the service","impact":"high","summary":"Oracle Siebel CRM Cloud Applications, in the Siebel Cloud Manager component, has a flaw in versions 17.0 through 26.9. An attacker with a low-privilege account and network access over HTTP can take over the cloud application and may reach other products.","category":"vendor","who_cares":["siebel-crm","oracle","cloud-applications"],"confidence":0.7,"needs_auth":"yes","worst_case":"attacker takes over the Siebel cloud application and may reach other products","analyst_note":"Check Oracle's Siebel CRM Critical Patch Update advisory and the NVD entry for the patched version and whether Oracle-managed cloud tenants need customer action.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-siebel-cloud-tenant"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000504,"input_tokens":3133,"output_tokens":381,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check Oracle's Siebel CRM Critical Patch Update advisory and the NVD entry for the patched version and whether Oracle-managed cloud tenants need customer action.","search":"'-101446':16A,19A '-2026':15A,18A '-26.9':113C '/av':177C '17.0':45B,112C '2026':80B '26.9':47B '3.1':73B,164C,176C '9.9':74B,167C 'access':61B,123C 'addit':145C 'affect':67B,110C 'allow':117C 'applic':26B,39B,65B,96C,131C,140C,162C 'applications':23A 'attack':9A,57B,120C,141C,150C 'avail':171C 'base':165C 'c/c':182C 'chang':71B,148C 'cloud':4A,22A,25B,38B,42B,95C,104C,130C,139C,161C 'cloud-appl':24B 'compon':40B,102C 'compromis':127C 'confidenti':168C 'critic':81B 'crm':3A,21A,33B,37B,94C,101C,129C,138C,160C 'cve':14A,17A 'cvss':72B,163C,173C,175C 'easili':114C 'exploit':86B,115C 'fix':75B 'flaw':50B 'h':185C 'h/a':184C 'h/i':183C 'host':30B 'http':8A,59B,125C 'impact':144C,172C 'integr':169C 'known':85B 'l/pr':179C 'l/ui':180C 'let':52B 'low':6A,55B,118C 'low-privileg':5A,54B 'manag':43B,105C 'may':142C 'n/ac':178C 'n/s':181C 'network':60B,122C 'octob':79B 'oracl':1A,27B,35B,77B,99C 'patch':82B 'poc':89B 'privileg':7A,56B,119C 'product':69B,97C,146C 'public':88B 'result':155C 'scope':70B,147C 'score':166C 'self':29B 'self-host':28B 'servic':13A 'siebel':2A,20A,32B,36B,41B,93C,100C,103C,128C,137C,159C 'siebel-crm':31B 'signific':143C 'success':149C 'support':106C 'take':10A,62B 'takeov':157C 'updat':83B 'vector':174C 'vendor':34B 'version':44B,107C 'via':124C 'vulner':90C,116C,134C,153C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101446","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101446","severity":null,"published_at":"2026-10-20T22:17:53+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101446:382","url":null,"severity":null,"published_at":"2026-10-23T23:10:31+00:00","modified_at":"2026-10-23T23:10:31+00:00","first_seen_at":"2026-10-23T23:10:31+00:00","fetched_at":"2026-10-23T23:10:31+00:00","note":"Oracle CPU Oct 2026 (Oct 20) and the CVE.org record confirm Siebel Cloud Manager, 17.0-26.9, CVSS 9.9. I could not read the Siebel row of Oracle's matrix (page truncated). The fixed version 26.10 comes only from Armis and may be its inference. No KEV entry, no public PoC or exploitation found per Armis, Feedly and Rapid7. I did not search social posts. Whether Oracle-managed cloud tenants need to act is unconfirmed."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1828,"url":"https://www.cve.org/CVERecord?id=CVE-2026-101446","title":"CVE Record CVE-2026-101446 (Oracle CNA)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1825,"url":"https://cve.armis.com/CVE-2026-101446","title":"Armis: CVE-2026-101446","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}