---
id: "CVE-2026-101457"
kind: "vulnerability"
aliases: ["CVE-2026-101457"]
title: "Oracle Siebel Life Sciences eDetailing: low-privileged SQL flaw allows full takeover"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Siebel Apps - Life Sciences (eDetailing)", "fixed": ["October 2026 CPU patch (26.10 inferred)"], "affected": ">= 17.0, <= 26.9", "ecosystem": "vendor"}]
ecosystems: []
tags: ["edetailing", "life-sciences-crm", "oracle-siebel", "self-hosted", "sql-injection", "vendor"]
not_affected_if: ["edetailing-not-deployed", "no-edetailing-component", "no-life-sciences-module", "versions-outside-17.0-26.9"]
published_at: "2026-10-20T22:17:54+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-24T00:10:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101457", "first_seen_at": "2026-10-23T21:57:21+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:10:30+00:00"}]
---

# Oracle Siebel Life Sciences eDetailing: low-privileged SQL flaw allows full takeover

Oracle Siebel Apps - Life Sciences (eDetailing component), versions 17.0 through 26.9, has a SQL-reachable flaw. Any low-privileged authenticated network user can take over the application and read, change or delete its data. CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N). Fixed by the October 2026 Critical Patch Update. No public exploitation or PoC found.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Siebel Apps - Life Sciences (eDetailing) affected >= 17.0, <= 26.9 fixed October 2026 CPU patch (26.10 inferred)

## How to check

Check your Siebel CRM version (Life Sciences installed, any release 17.0 to 26.9 is affected). Check whether the October 2026 CPU patch for Siebel CRM is applied in My Oracle Support. Check whether eDetailing is deployed and reachable by authenticated users.

## Fix

Apply the Siebel CRM patch from Oracle's October 2026 CPU through My Oracle Support (support.oracle.com). Releases after 26.9 (26.10) are outside the affected range, but I did not read the patch number on an Oracle page. Oracle publishes no workaround; if you cannot patch, limit access to eDetailing and remove unneeded low-privilege accounts.

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101457
- 2026-10-24T00:10:30+00:00 analyst — Oracle October 2026 CPU (Rev 1, 2026-10-20) lists it; CVE.org: affected 17.0-26.9, CVSS 8.8. Exact patch number is behind My Oracle Support; 26.10 as fixed release is inferred from affected range and sibling Siebel CVEs on Armis, not read on an Oracle page. No exploitation or PoC found; not in KEV. Social search skipped.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE-2026-101457 | Armis https://cve.armis.com/CVE-2026-101457
- [describes] CVE Record: CVE-2026-101457 https://www.cve.org/CVERecord?id=CVE-2026-101457

## From the sources

Vulnerability in the Siebel Apps - Life Sciences product of Oracle Siebel CRM (component: eDetailing).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Siebel Apps - Life Sciences.  Successful attacks of this vulnerability can result in takeover of Siebel Apps - Life Sciences. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_