How do I check whether I am affected by CVE-2026-101457?

Check your Siebel CRM version (Life Sciences installed, any release 17.0 to 26.9 is affected). Check whether the October 2026 CPU patch for Siebel CRM is applied in My Oracle Support. Check whether eDetailing is deployed and reachable by authenticated users.

What is the fix for CVE-2026-101457?

Apply the Siebel CRM patch from Oracle's October 2026 CPU through My Oracle Support (support.oracle.com). Releases after 26.9 (26.10) are outside the affected range, but I did not read the patch number on an Oracle page. Oracle publishes no workaround; if you cannot patch, limit access to eDetailing and remove unneeded low-privilege accounts.

Who is not affected by CVE-2026-101457?

Not affected if: edetailing-not-deployed, no-edetailing-component, no-life-sciences-module, versions-outside-17.0-26.9.

Live › vulnerability › CVE-2026-101457

Go to dashboard

high8.8Vendor

Oracle Siebel Life Sciences eDetailing: low-privileged SQL flaw allows full takeover

Oracle Siebel Apps - Life Sciences (eDetailing component), versions 17.0 through 26.9, has a SQL-reachable flaw. Any low-privileged authenticated network user can take over the application and read, change or delete its data. CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N). Fixed by the October 2026 Critical Patch Update. No public exploitation or PoC found.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

8.8

high

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 24, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Attacker takes over the Siebel application and reads or changes all its data.
CVSS said: 8.8. The facts above say medium; we keep the sources' high until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-101457

Go to dashboard

high8.8Vendor

Oracle Siebel Life Sciences eDetailing: low-privileged SQL flaw allows full takeover

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

8.8

high

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 24, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Attacker takes over the Siebel application and reads or changes all its data.
CVSS said: 8.8. The facts above say medium; we keep the sources' high until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Oracle Siebel Life Sciences eDetailing: low-privileged SQL flaw allows full takeover

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

Oracle Siebel Life Sciences eDetailing: low-privileged SQL flaw allows full takeover

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources