---
id: "CVE-2026-101526"
kind: "vulnerability"
aliases: ["CVE-2026-101526"]
title: "Oracle Enterprise Manager for Siebel: low-privilege network attacker takes over server"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Oracle Enterprise Manager for Siebel", "fixed": [], "affected": "13.5, 24.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["oracle-cpu", "oracle-enterprise-manager", "other", "self-hosted", "siebel"]
not_affected_if: ["not-installed", "other-versions"]
published_at: "2026-10-20T22:18:01+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-24T00:09:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101526", "first_seen_at": "2026-10-23T21:57:22+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:09:27+00:00"}]
---

# Oracle Enterprise Manager for Siebel: low-privilege network attacker takes over server

Oracle Enterprise Manager for Siebel 13.5 and 24.1 (Configuration Management component) has a privilege flaw (CWE-269) reachable over HTTP. A low-privilege authenticated attacker on the network can take over the product. CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N). Fixed by the October 2026 Critical Patch Update; the exact patch number is in a My Oracle Support patch availability document.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Enterprise Manager for Siebel affected 13.5, 24.1 fixed ?

## How to check

In Enterprise Manager, check the version of the Siebel plug-in/Enterprise Manager for Siebel; versions 13.5 and 24.1 are affected. Then check whether the October 2026 CPU patch for Oracle Enterprise Manager is applied (OPatch lsinventory against the OMS home). Restrict network access to the EM console to trusted hosts and audit low-privilege accounts.

## Fix

Apply the Oracle Critical Patch Update of October 2026 for Oracle Enterprise Manager (patch availability document for Oracle Enterprise Manager on My Oracle Support). Exact patch ID unknown: it needs an MOS login to read.

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101526
- 2026-10-24T00:09:27+00:00 analyst — Oracle CPU Oct 2026 lists Enterprise Manager for Siebel 13.5, 24.1 (patch doc in MOS, behind login, so exact patch/RU number unknown). VulDB says no exploit; no exploitation evidence found; social not searched (Oracle CPU, no product chatter expected). Sibling CVE-2026-101525 has identical text.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] VulDB: Oracle Enterprise Manager for Siebel Configuration Management (CWE-269) https://vuldb.com/vuln/423269

## From the sources

Vulnerability in the Oracle Enterprise Manager for Siebel product of Oracle Enterprise Manager (component: Configuration Management).  Supported versions that are affected are 13.5 and  24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager for Siebel.  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager for Siebel. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_