{"id":"CVE-2026-101458","kind":"vulnerability","aliases":["CVE-2026-101458"],"related":[],"title":"Oracle Siebel CRM Deployment: unauthenticated HTTP flaw exposes and alters CRM data","description":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data as well as  unauthorized update, insert or delete access to some of Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).","summary":"Oracle Siebel CRM Deployment's Server Infrastructure component has a flaw that lets a remote attacker with network access over HTTP, without logging in, reach critical CRM data. The attacker can read all data the deployment can access and modify or delete some of it.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise-crm","oracle","other","self-hosted","siebel-crm"],"not_affected_if":["version-outside-17.0-26.9"],"how_to_check":"- Check the installed Siebel CRM Deployment version against the affected range 17.0-26.9 in the vendor's patch records\n- unknown for other exact commands or files","fix":"- Apply the Oracle Siebel CRM patch referenced in the Oracle Critical Patch Update advisory for the affected release\n- unknown for the specific fixed version, as the sources do not state it","status":"open","published_at":"2026-10-20T22:17:54+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T03:04:12+00:00","updated_at":"2026-10-25T03:04:12+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-25T03:04:12Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Siebel CRM patch referenced in the Oracle Critical Patch Update advisory for the affected release\n- unknown for the specific fixed version, as the sources do not state it","reach":"network","title":"Oracle Siebel CRM Deployment: unauthenticated HTTP flaw exposes and alters CRM data","impact":"high","summary":"Oracle Siebel CRM Deployment's Server Infrastructure component has a flaw that lets a remote attacker with network access over HTTP, without logging in, reach critical CRM data. The attacker can read all data the deployment can access and modify or delete some of it.","category":"other","nicknames":[],"who_cares":["siebel-crm","oracle","self-hosted","enterprise-crm"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker reads critical CRM data and modifies or deletes some records","analyst_note":"Confirm the fixed Siebel CRM Deployment version and patch identifier from the Oracle Critical Patch Update advisory for this CVE.","how_to_check":"- Check the installed Siebel CRM Deployment version against the affected range 17.0-26.9 in the vendor's patch records\n- unknown for other exact commands or files","needs_analyst":true,"not_affected_if":["version-outside-17.0-26.9"],"who_is_affected":"Organisations running Oracle Siebel CRM Deployment in the affected supported range 17.0-26.9 that expose the Server Infrastructure over HTTP to a network the attacker can reach. Teams not running Siebel CRM, or running versions outside that range, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000651,"input_tokens":3508,"output_tokens":601,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101458':15A,18A '-2026':14A,17A '-26.9':93C '/av':163C '17.0':92C '3.1':151C,162C '8.2':154C 'access':48B,67B,102C,119C,125C,131C,141C,148C 'affect':90C 'allow':97C 'alter':10A 'attack':45B,59B,99C,111C 'base':152C 'complet':124C 'compon':37B,83C 'compromis':106C 'confidenti':155C 'critic':55B,121C 'crm':3A,11A,21B,29B,32B,56B,76C,82C,108C,129C,146C 'cve':13A,16A 'cvss':150C,159C,161C 'data':12A,57B,63B,122C,132C,149C 'delet':71B,140C 'deploy':4A,33B,65B,77C,109C,130C,147C 'easili':94C 'enterpris':20B 'enterprise-crm':19B 'exploit':95C 'expos':8A 'flaw':7A,40B 'h/i':169C 'host':26B 'http':6A,50B,104C 'impact':158C 'infrastructur':36B,85C 'insert':138C 'integr':157C 'l/a':170C 'l/pr':165C 'let':42B 'log':52B 'modifi':69B 'n':171C 'n/ac':164C 'n/s':167C 'n/ui':166C 'network':47B,101C 'oracl':1A,22B,30B,80C 'product':78C 'reach':54B 'read':61B 'remot':44B 'result':116C 'score':153C 'self':25B 'self-host':24B 'server':35B,84C 'siebel':2A,28B,31B,75C,81C,107C,128C,145C 'siebel-crm':27B 'success':110C 'support':86C 'u/c':168C 'unauthent':5A,98C 'unauthor':118C,136C 'updat':137C 'vector':160C 'version':87C 'via':103C 'vulner':72C,96C,114C 'well':134C 'without':51B","nicknames":[],"mitigations":[],"who_affected":"Organisations running Oracle Siebel CRM Deployment in the affected supported range 17.0-26.9 that expose the Server Infrastructure over HTTP to a network the attacker can reach. Teams not running Siebel CRM, or running versions outside that range, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101458","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101458","severity":null,"published_at":"2026-10-20T22:17:54+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}