{"id":"CVE-2026-101451","kind":"vulnerability","aliases":["CVE-2026-101451"],"related":[],"title":"Oracle Siebel Life Sciences Web UI flaw lets low-privilege users take over data","description":"Vulnerability in the Siebel Life Sciences product of Oracle Siebel CRM (component: Web UI).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Life Sciences.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel Life Sciences, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel Life Sciences accessible data as well as  unauthorized access to critical data or complete access to all Siebel Life Sciences accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).","summary":"Oracle Siebel Life Sciences (Siebel CRM, Web UI component), versions 17.0 through 26.9: a low-privileged user with network access over HTTP can compromise the product, but it needs a second user to interact (UI:R). Scope changes. Impact is unauthorized read of all accessible data and creation, change or deletion of critical data. CVSS 3.1 8.7. Fixed in Oracle's October 2026 Critical Patch Update. A third-party writeup (Armis) says it is XSS, but Oracle's description does not say so.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Siebel Life Sciences","fixed":[],"affected":">= 17.0, <= 26.9","ecosystem":"vendor"}],"ecosystems":[],"tags":["authenticated","life-sciences","oracle","oracle-crm","self-hosted","siebel","siebel-crm","vendor"],"not_affected_if":["auth-required","managed-hosting"],"how_to_check":"Find your Siebel Life Sciences version (Siebel CRM release, e.g. 25.x or 26.x). Anything from 17.0 through 26.9 is affected unless the October 2026 CPU patch is applied. Check the patch level against the Siebel entry in Oracle's patch availability document (MOS).","fix":"Apply the Siebel CRM patch from Oracle's October 2026 CPU through My Oracle Support (patch availability document for Siebel CRM). Exact fixed build unknown: Oracle's page was not readable here. Armis says 26.10 or later, unverified.","status":"open","published_at":"2026-10-20T22:17:53+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-23T22:37:12+00:00","updated_at":"2026-10-24T00:11:33+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T22:37:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle Siebel Life Sciences Web UI flaw lets low-privilege users take over data","impact":"high","summary":"Oracle Siebel Life Sciences Web UI, versions 17.0 through 26.9, has a flaw an authenticated low-privilege user can reach over HTTP. A successful attack can create, change or delete critical data and read all data the application can access.","category":"vendor","who_cares":["siebel","oracle-crm","life-sciences","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"attacker reads and modifies all Siebel Life Sciences data","analyst_note":"Find Oracle's Critical Patch Update advisory for the patched Siebel Life Sciences build and check the affected version range against the CVE record.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required"],"user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000494,"input_tokens":3150,"output_tokens":357,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Oracle's Critical Patch Update advisory for the patched Siebel Life Sciences build and check the affected version range against the CVE record.","search":"'-101451':18A,21A '-2026':17A,20A '-26.9':146C '/av':248C '17.0':51B,145C '2026':104B '26.9':53B '3.1':97B,236C,247C '8.7':98B,239C 'access':61B,86B,156C,206C,215C,221C,227C,233C 'addit':189C 'affect':143C 'allow':150C 'armi':113B 'attack':153C,165C,175C,185C,194C 'authent':25B 'base':237C 'c/c':253C 'chang':79B,90B,192C 'complet':226C 'compon':49B,136C 'compromis':65B,160C 'confidenti':240C 'creation':89B,202C 'critic':94B,105B,208C,223C 'crm':32B,39B,46B,135C 'cve':16A,19A 'cvss':96B,235C,244C,246C 'data':15A,87B,95B,209C,216C,224C,234C 'delet':92B,203C 'descript':121B 'easili':147C 'exploit':148C 'fix':99B 'flaw':7A 'h/a':255C 'h/i':254C 'host':35B 'http':63B,158C 'human':167C 'impact':80B,188C,243C 'integr':242C 'interact':75B,168C 'l/pr':250C 'l/ui':251C 'let':8A 'life':3A,23A,27B,43B,129C,162C,183C,213C,231C 'life-sci':26B 'low':10A,56B,151C 'low-privileg':9A,55B 'may':186C 'modif':205C 'n':256C 'n/ac':249C 'need':70B 'network':60B,155C 'octob':103B 'oracl':1A,29B,31B,41B,101B,119B,133C 'oracle-crm':30B 'parti':111B 'patch':106B 'person':171C 'privileg':11A,57B,152C 'product':67B,131C,190C 'r':77B 'r/s':252C 'read':83B 'requir':166C 'result':199C 'say':114B,124B 'scienc':4A,28B,44B,130C,163C,184C,214C,232C 'sciences':24A 'scope':78B,191C 'score':238C 'second':72B 'self':34B 'self-host':33B 'siebel':2A,22A,36B,38B,42B,45B,128C,134C,161C,182C,212C,230C 'siebel-crm':37B 'signific':187C 'success':164C,193C 'support':139C 'take':13A 'third':110B 'third-parti':109B 'ui':6A,48B,76B,138C 'unauthor':82B,201C,220C 'updat':107B 'user':12A,58B,73B 'vector':245C 'vendor':40B 'version':50B,140C 'via':157C 'vulner':125C,149C,179C,197C 'web':5A,47B,137C 'well':218C 'writeup':112B 'xss':117B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101451","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101451","severity":null,"published_at":"2026-10-20T22:17:53+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101451:605","url":null,"severity":null,"published_at":"2026-10-24T00:11:33+00:00","modified_at":"2026-10-24T00:11:33+00:00","first_seen_at":"2026-10-24T00:11:33+00:00","fetched_at":"2026-10-24T00:11:33+00:00","note":"Oracle CPU Oct 2026 (20 Oct) lists it; affected 17.0-26.9 confirmed by Rapid7/OpenCVE copies of Oracle's text (CVSS 3.1 8.7, AV:N/PR:L/UI:R/S:C). I could not read the Siebel section of Oracle's page (output truncated) or the MOS patch doc, so the fixed build is unknown; Armis says 26.10 but that looks inferred. Armis also calls it XSS, which Oracle's text does not say. No exploitation or PoC found; I did not search social posts."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2470,"url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-101451/","title":"Rapid7: CVE-2026-101451 (copy of Oracle risk matrix text)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":2471,"url":"https://cve.armis.com/CVE-2026-101451","title":"Armis: CVE-2026-101451","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}