Oracle Siebel CRM Cloud Applications: Unspecified vulnerability in Siebel Cloud Manager
Summary
Oracle Siebel CRM Cloud Applications, versions 22.3 through 26.9, contains a vulnerability in the Siebel Cloud Manager component. An unauthenticated attacker with adjacent network access to the communication segment of the hosting hardware can, under high attack complexity, create, modify or delete critical data and gain access to CRM data, with a scope change affecting other products. According to the CVSS vector, availability is not affected. Oracle lists the issue in its October 2026 Critical Patch Update.
Affected
- Oracle Siebel CRM Cloud Applications, versions 22.3 through 26.9 (inclusive)
Fixed in
- Unknown. Check the current revision of Oracle's October 2026 Critical Patch Update advisory for the fixed build.
Workaround
- No vendor workaround found in the sources reviewed.
- Until patched, restrict network access to Siebel hosts and their management segment.
Exploitation
- No in-the-wild exploitation or public proof-of-concept code known in the sources reviewed. This is not proof of absence.
- EPSS score of 0.00183 (low) according to one aggregator.
Our recommendation
- Confirm whether any Siebel CRM Cloud Applications instance in versions 22.3 to 26.9 is in use.
- Obtain the fixed build from Oracle's advisory and ask the hosting provider who applies patches and when.
- Restrict adjacent network access to Siebel hosts until patched.
- Monitor for vendor updates and apply them promptly.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Security Alert: October 2026 CPU www.oracle.com
- CVE-2026-101438 record (Vulners) vulners.com
- CVE-2026-101438 analysis (Strix) www.strix.ai
- October 2026 CPU overview (CVEBrief) cvebrief.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:16.
Original description (NVD)
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications. While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM Cloud Applications accessible data as well as unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 8.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.