{"id":"CVE-2026-101460","kind":"vulnerability","aliases":["CVE-2026-101460"],"related":[],"title":"Oracle Siebel CRM Deployment: unauthenticated network flaw exposes critical data","description":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","summary":"Oracle Siebel CRM Deployment's Server Infrastructure component has a flaw in versions 17.0 through 26.9 that lets an unauthenticated attacker reach it over TLS. A successful attack gives unauthorized read access to critical data held by the deployment.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise","oracle","self-hosted","siebel-crm","vendor"],"not_affected_if":["unaffected-version"],"how_to_check":"- Identify Siebel CRM Deployment installs and their version, for example via the installed Siebel release on the server (unknown exact command in sources)\n- Check whether the Siebel server endpoints are reachable from untrusted networks","fix":"- Apply the Oracle Critical Patch Update that addresses CVE-2026-101460 for the affected Siebel CRM release (exact patch name unknown)\n- Move affected versions off `17.0` through `26.9` once a fixed release is available (fixed version unknown)","status":"open","published_at":"2026-10-20T22:17:54+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T03:20:37+00:00","updated_at":"2026-10-25T03:20:37+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:20:37Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update that addresses CVE-2026-101460 for the affected Siebel CRM release (exact patch name unknown)\n- Move affected versions off `17.0` through `26.9` once a fixed release is available (fixed version unknown)","reach":"internet","title":"Oracle Siebel CRM Deployment: unauthenticated network flaw exposes critical data","impact":"medium","summary":"Oracle Siebel CRM Deployment's Server Infrastructure component has a flaw in versions 17.0 through 26.9 that lets an unauthenticated attacker reach it over TLS. A successful attack gives unauthorized read access to critical data held by the deployment.","category":"vendor","nicknames":[],"who_cares":["siebel-crm","oracle","self-hosted","enterprise"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated attacker reads critical Siebel CRM data over network","analyst_note":"Find Oracle's Critical Patch Update advisory and the fixed Siebel CRM Deployment version; the NVD entry gives no fix or check steps.","how_to_check":"- Identify Siebel CRM Deployment installs and their version, for example via the installed Siebel release on the server (unknown exact command in sources)\n- Check whether the Siebel server endpoints are reachable from untrusted networks","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Organisations running Oracle Siebel CRM Deployment in the affected version range 17.0 to 26.9 with the Server Infrastructure component reachable over the network. Deployments not running that version range, or not exposed to network access, are less exposed; the sources do not say more.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000666,"input_tokens":3467,"output_tokens":639,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101460':13A,16A '-2026':12A,15A '-26.9':86C '/av':137C '17.0':39B,85C '26.9':41B '3.1':127C,136C '7.5':130C 'access':57B,95C,112C,118C,124C 'affect':83C 'allow':90C 'attack':46B,53B,92C,104C 'base':128C 'complet':117C 'compon':33B,76C 'compromis':99C 'confidenti':131C 'critic':9A,59B,114C 'crm':3A,24B,28B,69C,75C,101C,122C 'cve':11A,14A 'cvss':126C,133C,135C 'data':10A,60B,115C,125C 'deploy':4A,29B,64B,70C,102C,123C 'easili':87C 'enterpris':17B 'exploit':88C 'expos':8A 'flaw':7A,36B 'give':54B 'h/i':143C 'held':61B 'host':21B 'impact':132C 'infrastructur':32B,78C 'l/pr':139C 'let':43B 'n':145C 'n/a':144C 'n/ac':138C 'n/s':141C 'n/ui':140C 'network':6A,94C 'oracl':1A,18B,26B,73C 'product':71C 'reach':47B 'read':56B 'result':109C 'score':129C 'self':20B 'self-host':19B 'server':31B,77C 'siebel':2A,23B,27B,68C,74C,100C,121C 'siebel-crm':22B 'success':52B,103C 'support':79C 'tls':50B,97C 'u/c':142C 'unauthent':5A,45B,91C 'unauthor':55B,111C 'vector':134C 'vendor':25B 'version':38B,80C 'via':96C 'vulner':65C,89C,107C","nicknames":[],"mitigations":[],"who_affected":"Organisations running Oracle Siebel CRM Deployment in the affected version range 17.0 to 26.9 with the Server Infrastructure component reachable over the network. Deployments not running that version range, or not exposed to network access, are less exposed; the sources do not say more.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101460","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101460","severity":null,"published_at":"2026-10-20T22:17:54+00:00","modified_at":"2026-10-21T18:17:21+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}