Live › vulnerability › CVE-2026-101467
Go to dashboardOracle Siebel CRM End User has a flaw in its Portal Framework component that lets an unauthenticated attacker over the network create, modify, delete or read data the application can access. Exploitation is hard (high attack complexity) but needs no account or user action.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Siebel CRM End User deployments on supported versions 17.0 through 26.9, as listed in the advisory description; the sources do not say which configurations are exposed. Teams not running Siebel CRM End User can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Siebel CRM End User | vendor | >= 17.0, <= 26.9 | – |
Check your Siebel CRM version/patchset: affected if Siebel CRM End User is on 17.0 through 26.9 without the October 2026 CPU patch and the Portal Framework is reachable over HTTPS.
Apply the Siebel CRM patch from Oracle's October 2026 Critical Patch Update (via My Oracle Support patch availability document); exact patch level unknown, not public
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Portal Framework). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Siebel CRM End User. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM End User accessible data as well as unauthorized access to critical data or complete access to all Siebel CRM End User accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
This page as .md · .json · in your agent: get_signal("CVE-2026-101467")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.