{"id":"CVE-2026-101457","kind":"vulnerability","aliases":["CVE-2026-101457"],"related":[],"title":"Oracle Siebel Life Sciences eDetailing: low-privileged SQL flaw allows full takeover","description":"Vulnerability in the Siebel Apps - Life Sciences product of Oracle Siebel CRM (component: eDetailing).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Siebel Apps - Life Sciences.  Successful attacks of this vulnerability can result in takeover of Siebel Apps - Life Sciences. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Siebel Apps - Life Sciences (eDetailing component), versions 17.0 through 26.9, has a SQL-reachable flaw. Any low-privileged authenticated network user can take over the application and read, change or delete its data. CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N). Fixed by the October 2026 Critical Patch Update. No public exploitation or PoC found.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Siebel Apps - Life Sciences (eDetailing)","fixed":["October 2026 CPU patch (26.10 inferred)"],"affected":">= 17.0, <= 26.9","ecosystem":"vendor"}],"ecosystems":[],"tags":["edetailing","life-sciences-crm","oracle-siebel","self-hosted","sql-injection","vendor"],"not_affected_if":["edetailing-not-deployed","no-edetailing-component","no-life-sciences-module","versions-outside-17.0-26.9"],"how_to_check":"Check your Siebel CRM version (Life Sciences installed, any release 17.0 to 26.9 is affected). Check whether the October 2026 CPU patch for Siebel CRM is applied in My Oracle Support. Check whether eDetailing is deployed and reachable by authenticated users.","fix":"Apply the Siebel CRM patch from Oracle's October 2026 CPU through My Oracle Support (support.oracle.com). Releases after 26.9 (26.10) are outside the affected range, but I did not read the patch number on an Oracle page. Oracle publishes no workaround; if you cannot patch, limit access to eDetailing and remove unneeded low-privilege accounts.","status":"open","published_at":"2026-10-20T22:17:54+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-23T22:32:46+00:00","updated_at":"2026-10-24T00:10:30+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T22:32:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle Siebel Life Sciences eDetailing: low-privileged SQL flaw allows full takeover","impact":"high","summary":"Oracle Siebel Apps - Life Sciences, eDetailing component, versions 17.0 through 26.9, has a flaw reachable over the network via SQL. An attacker with only a low-privilege account can take over the application and read, change or disrupt its data.","category":"vendor","who_cares":["oracle-siebel","life-sciences-crm","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"attacker takes over the Siebel application and reads or changes all its data","analyst_note":"Find Oracle's Critical Patch Update advisory for this CVE to confirm the patched version and any workaround; the NVD entry gives no fix.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["versions-outside-17.0-26.9","no-eDetailing-component"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000499,"input_tokens":3057,"output_tokens":386,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Oracle's Critical Patch Update advisory for this CVE to confirm the patched version and any workaround; the NVD entry gives no fix.","search":"'-101457':16A,19A '-2026':15A,18A '-26.9':119C '/av':166C '17.0':48B,118C '2026':88B '26.9':50B '3.1':77B,153C,165C '8.8':78B,156C 'access':129C 'affect':116C 'allow':11A,123C 'app':42B,102C,135C,149C 'applic':68B 'apps':21A 'attack':126C,139C 'authent':61B 'av':79B 'avail':160C 'base':154C 'chang':71B 'compon':46B,110C 'compromis':133C 'confidenti':157C 'critic':89B 'crm':29B,109C 'cve':14A,17A 'cvss':76B,152C,162C,164C 'data':75B 'delet':73B 'easili':120C 'edetail':5A,25B,45B,111C 'edetailing':24A 'exploit':94B,121C 'fix':84B 'flaw':10A,56B 'found':97B 'full':12A 'h':174C 'h/a':173C 'h/i':172C 'host':35B 'impact':161C 'inject':38B 'integr':158C 'l/pr':81B,168C 'l/ui':82B,169C 'life':3A,22A,27B,43B,103C,136C,150C 'life-sciences-crm':26B 'low':7A,59B,124C 'low-privileg':6A,58B 'n':83B 'n/ac':80B,167C 'n/s':170C 'network':62B,128C 'octob':87B 'oracl':1A,31B,40B,107C 'oracle-siebel':30B 'patch':90B 'poc':96B 'privileg':8A,60B,125C 'product':105C 'public':93B 'reachabl':55B 'read':70B 'result':144C 'scienc':4A,28B,44B,104C,137C,151C 'sciences':23A 'score':155C 'self':34B 'self-host':33B 'siebel':2A,20A,32B,41B,101C,108C,134C,148C 'sql':9A,37B,54B,131C 'sql-inject':36B 'sql-reachabl':53B 'success':138C 'support':112C 'take':65B 'takeov':13A,146C 'u/c':171C 'updat':91B 'user':63B 'vector':163C 'vendor':39B 'version':47B,113C 'via':130C 'vulner':98C,122C,142C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101457","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101457","severity":null,"published_at":"2026-10-20T22:17:54+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101457:604","url":null,"severity":null,"published_at":"2026-10-24T00:10:30+00:00","modified_at":"2026-10-24T00:10:30+00:00","first_seen_at":"2026-10-24T00:10:30+00:00","fetched_at":"2026-10-24T00:10:30+00:00","note":"Oracle October 2026 CPU (Rev 1, 2026-10-20) lists it; CVE.org: affected 17.0-26.9, CVSS 8.8. Exact patch number is behind My Oracle Support; 26.10 as fixed release is inferred from affected range and sibling Siebel CVEs on Armis, not read on an Oracle page. No exploitation or PoC found; not in KEV. Social search skipped."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2462,"url":"https://cve.armis.com/CVE-2026-101457","title":"CVE-2026-101457 | Armis","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":2463,"url":"https://www.cve.org/CVERecord?id=CVE-2026-101457","title":"CVE Record: CVE-2026-101457","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}