{"id":"CVE-2026-101476","kind":"vulnerability","aliases":["CVE-2026-101476"],"related":[],"title":"Oracle Siebel CRM Marketing: unauthenticated flaw allows limited data changes","description":"Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel Apps - Marketing accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N).","summary":"Oracle Siebel CRM's Marketing component has a flaw reachable over HTTP without credentials. A successful attack, after a user takes an action, can modify or delete some data the application can access.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["oracle","siebel-crm","vendor"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-20T22:17:56+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T04:39:17+00:00","updated_at":"2026-10-25T04:39:17+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T04:39:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle Siebel CRM Marketing: unauthenticated flaw allows limited data changes","impact":"medium","summary":"Oracle Siebel CRM's Marketing component has a flaw reachable over HTTP without credentials. A successful attack, after a user takes an action, can modify or delete some data the application can access.","category":"vendor","nicknames":[],"who_cares":["siebel-crm","oracle"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthorized changes or deletion of some accessible Siebel Marketing data","analyst_note":"Check Oracle's Critical Patch Update advisory for the patched Siebel Marketing version and the exact affected build range (17.0-26.9 per NVD).","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000525,"input_tokens":3484,"output_tokens":354,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101476':13A,16A '-2026':12A,15A '-26.9':75C '/av':137C '17.0':74C '3.1':127C,136C '4.3':130C 'access':54B,84C,117C,124C 'action':44B 'affect':72C 'allow':7A,79C 'app':59C,90C,122C 'applic':52B 'attack':38B,81C,93C,103C,105C 'base':128C 'chang':10A 'compon':27B,66C 'compromis':88C 'credenti':35B 'crm':3A,20B,24B,65C 'cve':11A,14A 'cvss':126C,133C,135C 'data':9A,50B,125C 'delet':48B,116C 'easili':76C 'exploit':77C 'flaw':6A,30B 'http':33B,86C 'human':95C 'impact':132C 'insert':114C 'integr':131C 'interact':96C 'l/a':144C 'l/pr':139C 'limit':8A 'market':4A,26B,60C,67C,91C,123C 'modifi':46B 'n':145C 'n/ac':138C 'n/i':143C 'n/ui':140C 'network':83C 'oracl':1A,17B,22B,63C 'person':99C 'product':61C 'r/s':141C 'reachabl':31B 'requir':94C 'result':110C 'score':129C 'siebel':2A,19B,23B,58C,64C,89C,121C 'siebel-crm':18B 'success':37B,92C,104C 'support':68C 'take':42B 'u/c':142C 'unauthent':5A,80C 'unauthor':112C 'updat':113C 'user':41B 'vector':134C 'vendor':21B 'version':69C 'via':85C 'vulner':55C,78C,108C 'without':34B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101476","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101476","severity":null,"published_at":"2026-10-20T22:17:56+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}