{"id":"CVE-2026-101467","kind":"vulnerability","aliases":["CVE-2026-101467"],"related":[],"title":"Oracle Siebel CRM End User: Portal Framework flaw exposes critical data over HTTPS","description":"Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Portal Framework).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Siebel CRM End User.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM End User accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM End User accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","summary":"Oracle Siebel CRM End User has a flaw in its Portal Framework component that lets an unauthenticated attacker over the network create, modify, delete or read data the application can access. Exploitation is hard (high attack complexity) but needs no account or user action.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Siebel CRM End User","fixed":[],"affected":">= 17.0, <= 26.9","ecosystem":"vendor"}],"ecosystems":[],"tags":["https","oracle","self-hosted","siebel-crm","unauthenticated","vendor"],"not_affected_if":["not-internet-exposed","not-siebel-crm","siebel-not-deployed"],"how_to_check":"Check your Siebel CRM version/patchset: affected if Siebel CRM End User is on 17.0 through 26.9 without the October 2026 CPU patch and the Portal Framework is reachable over HTTPS.","fix":"Apply the Siebel CRM patch from Oracle's October 2026 Critical Patch Update (via My Oracle Support patch availability document); exact patch level unknown, not public","status":"open","published_at":"2026-10-20T22:17:55+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T03:27:05+00:00","updated_at":"2026-10-25T03:28:01+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:27:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Oracle Siebel CRM End User: Portal Framework flaw exposes critical data over HTTPS","impact":"high","summary":"Oracle Siebel CRM End User has a flaw in its Portal Framework component that lets an unauthenticated attacker over the network create, modify, delete or read data the application can access. Exploitation is hard (high attack complexity) but needs no account or user action.","category":"vendor","nicknames":[],"who_cares":["siebel-crm","oracle","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads or changes all data accessible to Siebel CRM End User","analyst_note":"Check Oracle's Critical Patch Update advisory for the fixed Siebel CRM End User patch level and any affected-configuration details; the NVD text gives no fix version.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["not-siebel-crm"],"who_is_affected":"Siebel CRM End User deployments on supported versions 17.0 through 26.9, as listed in the advisory description; the sources do not say which configurations are exposed. Teams not running Siebel CRM End User can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000581,"input_tokens":3501,"output_tokens":461,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Oracle's Critical Patch Update advisory for the fixed Siebel CRM End User patch level and any affected-configuration details; the NVD text gives no fix version.","search":"'-101467':16A,19A '-2026':15A,18A '-26.9':100C '/av':176C '17.0':99C '3.1':164C,175C '7.4':167C 'access':64B,110C,132C,142C,148C,154C,161C 'account':74B 'action':77B 'affect':97C 'allow':105C 'applic':62B 'attack':51B,69B,107C,120C 'base':165C 'complet':153C 'complex':70B 'compon':46B,90C 'compromis':114C 'confidenti':168C 'creat':55B 'creation':128C 'critic':10A,134C,150C 'crm':3A,21A,31B,36B,82C,89C,116C,139C,158C 'cve':14A,17A 'cvss':163C,172C,174C 'data':11A,60B,135C,143C,151C,162C 'delet':57B,129C 'difficult':101C 'end':4A,22A,37B,83C,117C,140C,159C 'exploit':65B,103C 'expos':9A 'flaw':8A,41B 'framework':7A,45B,92C 'h/a':183C 'h/i':182C 'h/pr':178C 'hard':67B 'high':68B 'host':28B 'https':13A,24B,112C 'impact':171C 'integr':170C 'let':48B 'modif':131C 'modifi':56B 'n':184C 'n/ac':177C 'n/s':180C 'n/ui':179C 'need':72B 'network':54B,109C 'oracl':1A,25B,34B,87C 'portal':6A,44B,91C 'product':85C 'read':59B 'result':125C 'score':166C 'self':27B 'self-host':26B 'siebel':2A,20A,30B,35B,81C,88C,115C,138C,157C 'siebel-crm':29B 'success':119C 'support':93C 'u/c':181C 'unauthent':32B,50B,106C 'unauthor':127C,147C 'user':5A,23A,38B,76B,84C,118C,141C,160C 'vector':173C 'vendor':33B 'version':94C 'via':111C 'vulner':78C,104C,123C 'well':145C","nicknames":[],"mitigations":[],"who_affected":"Siebel CRM End User deployments on supported versions 17.0 through 26.9, as listed in the advisory description; the sources do not say which configurations are exposed. Teams not running Siebel CRM End User can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101467","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101467","severity":null,"published_at":"2026-10-20T22:17:55+00:00","modified_at":"2026-10-21T18:17:21+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101467:722","url":null,"severity":null,"published_at":"2026-10-25T03:28:01+00:00","modified_at":"2026-10-25T03:28:01+00:00","first_seen_at":"2026-10-25T03:28:01+00:00","fetched_at":"2026-10-25T03:28:01+00:00","note":"Oracle CPU Oct 2026 (20 Oct) lists it; affected 17.0-26.9 per Oracle CNA text (CVSS 7.4, AV:N/AC:H/PR:N). Exact fixed patch level is in the Siebel patch availability doc on My Oracle Support (login needed), not read. No exploitation or PoC found; not KEV. Siebel risk matrix page was truncated, so nothing marked verified."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3186,"url":"https://www.cve.org/CVERecord?id=CVE-2026-101467","title":"CVE Record: CVE-2026-101467 (Oracle CNA text)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}