---
id: "CVE-2026-101458"
kind: "vulnerability"
aliases: ["CVE-2026-101458"]
title: "Oracle Siebel CRM Deployment: unauthenticated HTTP flaw exposes and alters CRM data"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["enterprise-crm", "oracle", "other", "self-hosted", "siebel-crm"]
not_affected_if: ["version-outside-17.0-26.9"]
published_at: "2026-10-20T22:17:54+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-25T03:04:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101458", "first_seen_at": "2026-10-23T21:57:21+00:00"}]
---

# Oracle Siebel CRM Deployment: unauthenticated HTTP flaw exposes and alters CRM data

Oracle Siebel CRM Deployment's Server Infrastructure component has a flaw that lets a remote attacker with network access over HTTP, without logging in, reach critical CRM data. The attacker can read all data the deployment can access and modify or delete some of it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Siebel CRM Deployment version against the affected range 17.0-26.9 in the vendor's patch records
- unknown for other exact commands or files

## Fix

- Apply the Oracle Siebel CRM patch referenced in the Oracle Critical Patch Update advisory for the affected release
- unknown for the specific fixed version, as the sources do not state it

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101458

## From the sources

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data as well as  unauthorized update, insert or delete access to some of Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_