How do I check whether I am affected by CVE-2026-101525?

Check whether you run Oracle Enterprise Manager for Siebel 13.5 or 24.1 (the Siebel plug-in/management deployment in Enterprise Manager). Then check whether the October 2026 CPU patch for it is applied, for example with 'opatch lspatches' on the OMS home. Compare against the patch listed for CVE-2026-101525 in the Oracle Patch Availability Document linked from the CPU advisory. The exact patch id is unknown.

What is the fix for CVE-2026-101525?

Apply the Oracle Critical Patch Update of October 2026 for Enterprise Manager for Siebel (patch id: see Oracle's Patch Availability Document for the October 2026 CPU). Until then, restrict HTTP access to the Enterprise Manager console to trusted networks and review low-privileged accounts.

Who is not affected by CVE-2026-101525?

Not affected if: managed-hosting, unknown.

Live › vulnerability › CVE-2026-101525

Go to dashboard

high8.8Runtime

Oracle Enterprise Manager for Siebel: low-privilege network flaw allows full takeover

Oracle Enterprise Manager for Siebel 13.5 and 24.1 have a flaw in the Configuration Management component. A low-privileged user with network access over HTTP can take over the product (CVSS 8.8, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fixed in Oracle's October 2026 Critical Patch Update. No known exploitation.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

8.8

high

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 24, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Attacker takes over Enterprise Manager for Siebel with low-privilege account.
CVSS said: 8.8. The facts above say medium; we keep the sources' high until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-101525

Go to dashboard

high8.8Runtime

Oracle Enterprise Manager for Siebel: low-privilege network flaw allows full takeover

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

8.8

high

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 24, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Attacker takes over Enterprise Manager for Siebel with low-privilege account.
CVSS said: 8.8. The facts above say medium; we keep the sources' high until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Oracle Enterprise Manager for Siebel: low-privilege network flaw allows full takeover

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

Oracle Enterprise Manager for Siebel: low-privilege network flaw allows full takeover

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources