{"id":"CVE-2026-101526","kind":"vulnerability","aliases":["CVE-2026-101526"],"related":[],"title":"Oracle Enterprise Manager for Siebel: low-privilege network attacker takes over server","description":"Vulnerability in the Oracle Enterprise Manager for Siebel product of Oracle Enterprise Manager (component: Configuration Management).  Supported versions that are affected are 13.5 and  24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager for Siebel.  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager for Siebel. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Enterprise Manager for Siebel 13.5 and 24.1 (Configuration Management component) has a privilege flaw (CWE-269) reachable over HTTP. A low-privilege authenticated attacker on the network can take over the product. CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N). Fixed by the October 2026 Critical Patch Update; the exact patch number is in a My Oracle Support patch availability document.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Enterprise Manager for Siebel","fixed":[],"affected":"13.5, 24.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["oracle-cpu","oracle-enterprise-manager","other","self-hosted","siebel"],"not_affected_if":["not-installed","other-versions"],"how_to_check":"In Enterprise Manager, check the version of the Siebel plug-in/Enterprise Manager for Siebel; versions 13.5 and 24.1 are affected. Then check whether the October 2026 CPU patch for Oracle Enterprise Manager is applied (OPatch lsinventory against the OMS home). Restrict network access to the EM console to trusted hosts and audit low-privilege accounts.","fix":"Apply the Oracle Critical Patch Update of October 2026 for Oracle Enterprise Manager (patch availability document for Oracle Enterprise Manager on My Oracle Support). Exact patch ID unknown: it needs an MOS login to read.","status":"open","published_at":"2026-10-20T22:18:01+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-23T22:32:44+00:00","updated_at":"2026-10-24T00:09:27+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-23T22:32:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown: the sources do not name a patched version or Oracle patch.","reach":"network","title":"Oracle Enterprise Manager for Siebel: low-privilege network attacker takes over server","impact":"high","summary":"Oracle Enterprise Manager for Siebel versions 13.5 and 24.1 have a flaw in the Configuration Management component that can be triggered over HTTP. An attacker with a low-privilege account on the network can take over the product, with CVSS 8.8 covering confidentiality, integrity and availability.","category":"other","who_cares":["oracle-enterprise-manager","siebel","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"attacker takes over the Enterprise Manager server completely","analyst_note":"Find the Oracle Critical Patch Update advisory naming the fixed versions for 13.5 and 24.1; the NVD page at https://nvd.nist.gov/vuln/detail/CVE-2026-101526 has no patch detail.","how_to_check":"Check whether you run Oracle Enterprise Manager for Siebel version 13.5 or 24.1.\nunknown: the sources do not give a file, setting or command to confirm exposure beyond the version.","needs_analyst":true,"not_affected_if":["other-versions"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000988,"input_tokens":3070,"output_tokens":1361,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Oracle Critical Patch Update advisory naming the fixed versions for 13.5 and 24.1; the NVD page at https://nvd.nist.gov/vuln/detail/CVE-2026-101526 has no patch detail.","search":"'-101526':16A,19A '-2026':15A,18A '-269':53B '/av':173C '13.5':42B,122C '2026':83B '24.1':44B,124C '3.1':72B,160C,172C '8.8':73B,163C 'access':134C 'affect':120C 'allow':128C 'attack':10A,62B,131C,145C 'authent':61B 'av':74B 'avail':98B,167C 'base':161C 'compon':47B,113C 'compromis':138C 'confidenti':164C 'configur':45B,114C 'cpu':27B 'critic':84B 'cve':14A,17A 'cvss':71B,159C,169C,171C 'cwe':52B 'document':99B 'easili':125C 'enterpris':2A,30B,38B,104C,111C,140C,155C 'enterprise':21A 'exact':88B 'exploit':126C 'fix':79B 'flaw':51B 'for':23A 'h':181C 'h/a':180C 'h/i':179C 'host':35B 'http':56B,136C 'impact':168C 'integr':165C 'l/pr':76B,175C 'l/ui':77B,176C 'low':7A,59B,129C 'low-privileg':6A,58B 'manag':3A,31B,39B,46B,105C,112C,115C,141C,156C 'manager':22A 'n':78B 'n/ac':75B,174C 'n/s':177C 'network':9A,65B,133C 'number':90B 'octob':82B 'oracl':1A,26B,29B,37B,95B,103C,110C,139C,154C 'oracle':20A 'oracle-cpu':25B 'oracle-enterprise-manag':28B 'patch':85B,89B,97B 'privileg':8A,50B,60B,130C 'product':70B,108C 'reachabl':54B 'result':150C 'score':162C 'self':34B 'self-host':33B 'server':13A 'siebel':5A,24A,36B,41B,107C,143C,158C 'success':144C 'support':96B,116C 'take':11A,67B 'takeov':152C 'u/c':178C 'updat':86B 'vector':170C 'version':117C 'via':135C 'vulner':100C,127C,148C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101526","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101526","severity":null,"published_at":"2026-10-20T22:18:01+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101526:598","url":null,"severity":null,"published_at":"2026-10-24T00:09:27+00:00","modified_at":"2026-10-24T00:09:27+00:00","first_seen_at":"2026-10-24T00:09:27+00:00","fetched_at":"2026-10-24T00:09:27+00:00","note":"Oracle CPU Oct 2026 lists Enterprise Manager for Siebel 13.5, 24.1 (patch doc in MOS, behind login, so exact patch/RU number unknown). VulDB says no exploit; no exploitation evidence found; social not searched (Oracle CPU, no product chatter expected). Sibling CVE-2026-101525 has identical text."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2378,"url":"https://vuldb.com/vuln/423269","title":"VulDB: Oracle Enterprise Manager for Siebel Configuration Management (CWE-269)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}