{"id":"CVE-2026-101525","kind":"vulnerability","aliases":["CVE-2026-101525"],"related":[],"title":"Oracle Enterprise Manager for Siebel: low-privilege network flaw allows full takeover","description":"Vulnerability in the Oracle Enterprise Manager for Siebel product of Oracle Enterprise Manager (component: Configuration Management).  Supported versions that are affected are 13.5 and  24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager for Siebel.  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager for Siebel. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Enterprise Manager for Siebel 13.5 and 24.1 have a flaw in the Configuration Management component. A low-privileged user with network access over HTTP can take over the product (CVSS 8.8, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fixed in Oracle's October 2026 Critical Patch Update. No known exploitation.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Enterprise Manager for Siebel","fixed":[],"affected":"13.5, 24.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["enterprise-manager","oracle","runtime","self-hosted","siebel"],"not_affected_if":["managed-hosting","unknown"],"how_to_check":"Check whether you run Oracle Enterprise Manager for Siebel 13.5 or 24.1 (the Siebel plug-in/management deployment in Enterprise Manager). Then check whether the October 2026 CPU patch for it is applied, for example with 'opatch lspatches' on the OMS home. Compare against the patch listed for CVE-2026-101525 in the Oracle Patch Availability Document linked from the CPU advisory. The exact patch id is unknown.","fix":"Apply the Oracle Critical Patch Update of October 2026 for Enterprise Manager for Siebel (patch id: see Oracle's Patch Availability Document for the October 2026 CPU). Until then, restrict HTTP access to the Enterprise Manager console to trusted networks and review low-privileged accounts.","status":"open","published_at":"2026-10-20T22:18:01+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-23T22:32:43+00:00","updated_at":"2026-10-24T00:09:30+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-23T22:32:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle Enterprise Manager for Siebel: low-privilege network flaw allows full takeover","impact":"high","summary":"Oracle Enterprise Manager for Siebel versions 13.5 and 24.1 contain a flaw in the Configuration Management component. A low-privileged user with network access over HTTP can take over the product.","category":"runtime","who_cares":["oracle","siebel","enterprise-manager"],"confidence":0.6,"needs_auth":"yes","worst_case":"attacker takes over Enterprise Manager for Siebel with low-privilege account","analyst_note":"Find Oracle's Critical Patch Update advisory for the Siebel EM 13.5 and 24.1 patch level and the affected component details at https://nvd.nist.gov/vuln/detail/CVE-2026-101525.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000491,"input_tokens":3070,"output_tokens":369,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Oracle's Critical Patch Update advisory for the Siebel EM 13.5 and 24.1 patch level and the affected component details at https://nvd.nist.gov/vuln/detail/CVE-2026-101525.","search":"'-101525':16A,19A '-2026':15A,18A '/av':69B,163C '13.5':39B,112C '2026':83B '24.1':41B,114C '3.1':68B,150C,162C '8.8':66B,153C 'access':57B,124C 'affect':110C 'allow':11A,118C 'attack':121C,135C 'avail':157C 'base':151C 'compon':49B,103C 'compromis':128C 'confidenti':154C 'configur':47B,104C 'critic':84B 'cve':14A,17A 'cvss':65B,67B,149C,159C,161C 'easili':115C 'enterpris':2A,26B,35B,94C,101C,130C,145C 'enterprise':21A 'enterprise-manag':25B 'exploit':89B,116C 'fix':78B 'flaw':10A,44B 'for':23A 'full':12A 'h':77B,171C 'h/a':76B,170C 'h/i':75B,169C 'host':32B 'http':59B,126C 'impact':158C 'integr':155C 'known':88B 'l/pr':71B,165C 'l/ui':72B,166C 'low':7A,52B,119C 'low-privileg':6A,51B 'manag':3A,27B,36B,48B,95C,102C,105C,131C,146C 'manager':22A 'n/ac':70B,164C 'n/s':73B,167C 'network':9A,56B,123C 'octob':82B 'oracl':1A,28B,34B,80B,93C,100C,129C,144C 'oracle':20A 'patch':85B 'privileg':8A,53B,120C 'product':64B,98C 'result':140C 'runtim':29B 'score':152C 'self':31B 'self-host':30B 'siebel':5A,24A,33B,38B,97C,133C,148C 'success':134C 'support':106C 'take':61B 'takeov':13A,142C 'u/c':74B,168C 'updat':86B 'user':54B 'vector':160C 'version':107C 'via':125C 'vulner':90C,117C,138C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101525","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101525","severity":null,"published_at":"2026-10-20T22:18:01+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101525:599","url":null,"severity":null,"published_at":"2026-10-24T00:09:30+00:00","modified_at":"2026-10-24T00:09:30+00:00","first_seen_at":"2026-10-24T00:09:30+00:00","fetched_at":"2026-10-24T00:09:30+00:00","note":"Oracle CPU Oct 2026 (cpuoct2026) lists it; NVD/CVE.org/VulDB agree on versions 13.5 and 24.1, CVSS 8.8, CWE-269 per VulDB. Exact patch number is in Oracle's Patch Availability Document / Siebel risk matrix, which I did not read, so fixed versions stay unknown. Armis says 'unauthenticated', which contradicts Oracle's PR:L (low privileges); I used Oracle's wording. No exploitation or public PoC found (VulDB: no exploit; Armis: no evidence). Did not search social posts; no named issue."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1639,"url":"https://www.oracle.com/security-alerts/cpuoct2026verbose.html","title":"Text Form of Oracle CPU October 2026 Risk Matrices","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":2381,"url":"https://vuldb.com/vuln/423268","title":"VulDB: Oracle Enterprise Manager for Siebel Configuration Management (CWE-269), no exploit","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}