---
id: "CVE-2026-101451"
kind: "vulnerability"
aliases: ["CVE-2026-101451"]
title: "Oracle Siebel Life Sciences Web UI flaw lets low-privilege users take over data"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Siebel Life Sciences", "fixed": [], "affected": ">= 17.0, <= 26.9", "ecosystem": "vendor"}]
ecosystems: []
tags: ["authenticated", "life-sciences", "oracle", "oracle-crm", "self-hosted", "siebel", "siebel-crm", "vendor"]
not_affected_if: ["auth-required", "managed-hosting"]
published_at: "2026-10-20T22:17:53+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-24T00:11:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101451", "first_seen_at": "2026-10-23T21:57:21+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:11:33+00:00"}]
---

# Oracle Siebel Life Sciences Web UI flaw lets low-privilege users take over data

Oracle Siebel Life Sciences (Siebel CRM, Web UI component), versions 17.0 through 26.9: a low-privileged user with network access over HTTP can compromise the product, but it needs a second user to interact (UI:R). Scope changes. Impact is unauthorized read of all accessible data and creation, change or deletion of critical data. CVSS 3.1 8.7. Fixed in Oracle's October 2026 Critical Patch Update. A third-party writeup (Armis) says it is XSS, but Oracle's description does not say so.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Siebel Life Sciences affected >= 17.0, <= 26.9 fixed ?

## How to check

Find your Siebel Life Sciences version (Siebel CRM release, e.g. 25.x or 26.x). Anything from 17.0 through 26.9 is affected unless the October 2026 CPU patch is applied. Check the patch level against the Siebel entry in Oracle's patch availability document (MOS).

## Fix

Apply the Siebel CRM patch from Oracle's October 2026 CPU through My Oracle Support (patch availability document for Siebel CRM). Exact fixed build unknown: Oracle's page was not readable here. Armis says 26.10 or later, unverified.

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101451
- 2026-10-24T00:11:33+00:00 analyst — Oracle CPU Oct 2026 (20 Oct) lists it; affected 17.0-26.9 confirmed by Rapid7/OpenCVE copies of Oracle's text (CVSS 3.1 8.7, AV:N/PR:L/UI:R/S:C). I could not read the Siebel section of Oracle's page (output truncated) or the MOS patch doc, so the fixed build is unknown; Armis says 26.10 but that looks inferred. Armis also calls it XSS, which Oracle's text does not say. No exploitation or PoC found; I did not search social posts.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] Rapid7: CVE-2026-101451 (copy of Oracle risk matrix text) https://www.rapid7.com/db/vulnerabilities/cve-2026-101451/
- [mentions] Armis: CVE-2026-101451 https://cve.armis.com/CVE-2026-101451

## From the sources

Vulnerability in the Siebel Life Sciences product of Oracle Siebel CRM (component: Web UI).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Life Sciences.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel Life Sciences, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel Life Sciences accessible data as well as  unauthorized access to critical data or complete access to all Siebel Life Sciences accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_