---
id: "CVE-2026-101446"
kind: "vulnerability"
aliases: ["CVE-2026-101446"]
title: "Oracle Siebel CRM Cloud: low-privilege HTTP attacker takes over the service"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Siebel CRM Cloud Applications", "fixed": ["see Oracle CPU Oct 2026 (26.10 per Armis, unconfirmed)"], "affected": ">= 17.0, <= 26.9", "ecosystem": "vendor"}]
ecosystems: []
tags: ["cloud-applications", "oracle", "self-hosted", "siebel-crm", "vendor"]
not_affected_if: ["managed-hosting", "no-siebel-cloud-tenant"]
published_at: "2026-10-20T22:17:53+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-23T23:10:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101446", "first_seen_at": "2026-10-23T21:57:21+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:10:31+00:00"}]
---

# Oracle Siebel CRM Cloud: low-privilege HTTP attacker takes over the service

Oracle Siebel CRM Cloud Applications (component Siebel Cloud Manager), versions 17.0 through 26.9, has a flaw that lets a low-privilege attacker with HTTP network access take over the application and affect other products (scope change). CVSS 3.1 9.9, fixed in Oracle's October 2026 Critical Patch Update. No known exploitation or public PoC.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Siebel CRM Cloud Applications affected >= 17.0, <= 26.9 fixed see Oracle CPU Oct 2026 (26.10 per Armis, unconfirmed)

## How to check

Check your Siebel CRM Cloud Applications version: 17.0 through 26.9 is affected. Check whether the Siebel Cloud Manager HTTP interface is reachable from untrusted networks, and list which low-privilege accounts can reach it. Check whether the October 2026 CPU patch is applied in Oracle Support.

## Fix

Apply the Siebel CRM patch from Oracle's October 2026 CPU via Oracle Support (support.oracle.com). Armis says the fixed version is 26.10 or later, but Oracle's own page was not confirmed. Until patched, restrict HTTP access to Siebel Cloud Manager to trusted admin networks and audit low-privilege accounts.

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101446
- 2026-10-23T23:10:31+00:00 analyst — Oracle CPU Oct 2026 (Oct 20) and the CVE.org record confirm Siebel Cloud Manager, 17.0-26.9, CVSS 9.9. I could not read the Siebel row of Oracle's matrix (page truncated). The fixed version 26.10 comes only from Armis and may be its inference. No KEV entry, no public PoC or exploitation found per Armis, Feedly and Rapid7. I did not search social posts. Whether Oracle-managed cloud tenants need to act is unconfirmed.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [advisory] CVE Record CVE-2026-101446 (Oracle CNA) https://www.cve.org/CVERecord?id=CVE-2026-101446
- [mentions] Armis: CVE-2026-101446 https://cve.armis.com/CVE-2026-101446

## From the sources

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Cloud Applications.  While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Siebel CRM Cloud Applications. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_