---
id: "CVE-2026-101467"
kind: "vulnerability"
aliases: ["CVE-2026-101467"]
title: "Oracle Siebel CRM End User: Portal Framework flaw exposes critical data over HTTPS"
severity: "high"
cvss: 7.4
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Siebel CRM End User", "fixed": [], "affected": ">= 17.0, <= 26.9", "ecosystem": "vendor"}]
ecosystems: []
tags: ["https", "oracle", "self-hosted", "siebel-crm", "unauthenticated", "vendor"]
not_affected_if: ["not-internet-exposed", "not-siebel-crm", "siebel-not-deployed"]
published_at: "2026-10-20T22:17:55+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-25T03:28:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101467", "first_seen_at": "2026-10-23T21:57:21+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:28:01+00:00"}]
---

# Oracle Siebel CRM End User: Portal Framework flaw exposes critical data over HTTPS

Oracle Siebel CRM End User has a flaw in its Portal Framework component that lets an unauthenticated attacker over the network create, modify, delete or read data the application can access. Exploitation is hard (high attack complexity) but needs no account or user action.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Siebel CRM End User affected >= 17.0, <= 26.9 fixed ?

## How to check

Check your Siebel CRM version/patchset: affected if Siebel CRM End User is on 17.0 through 26.9 without the October 2026 CPU patch and the Portal Framework is reachable over HTTPS.

## Fix

Apply the Siebel CRM patch from Oracle's October 2026 Critical Patch Update (via My Oracle Support patch availability document); exact patch level unknown, not public

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101467
- 2026-10-25T03:28:01+00:00 analyst — Oracle CPU Oct 2026 (20 Oct) lists it; affected 17.0-26.9 per Oracle CNA text (CVSS 7.4, AV:N/AC:H/PR:N). Exact fixed patch level is in the Siebel patch availability doc on My Oracle Support (login needed), not read. No exploitation or PoC found; not KEV. Siebel risk matrix page was truncated, so nothing marked verified.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE Record: CVE-2026-101467 (Oracle CNA text) https://www.cve.org/CVERecord?id=CVE-2026-101467

## From the sources

Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Portal Framework).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Siebel CRM End User.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM End User accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM End User accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_