Oracle Siebel CRM Cloud Applications: Remote takeover via HTTP (Siebel Cloud Manager)
Summary
Oracle Siebel CRM Cloud Applications, component Siebel Cloud Manager, is affected by a critical vulnerability (CVSS 9.9). A remote attacker with network access via HTTP and low privileges can compromise the application, with impact extending beyond its security scope. Successful exploitation can lead to takeover of Siebel CRM Cloud Applications, so an attacker needs a valid low-privilege account. The vulnerability is listed in Oracle's October 2026 Critical Patch Update.
Affected
- Oracle Siebel CRM Cloud Applications, component Siebel Cloud Manager
- Versions 17.0 to 26.9 according to the CNA record; the lower bound is disputed (sibling CVEs list 22.3), to be confirmed in Oracle's advisory
Fixed in
Unknown. Check Oracle's October 2026 Critical Patch Update advisory for fixed versions and whether the cloud service is patched centrally.
Workaround
Unknown. No Oracle mitigation was found. Generic measure: restrict network access to Siebel administrative and cloud management interfaces.
Exploitation
- No evidence of active exploitation found at the time of writing; check CISA KEV for current status.
- No public proof of concept found.
- NVD analysis was pending at the time of writing.
Our recommendation
- Determine whether your organisation uses Siebel CRM Cloud Applications, including partner-hosted or integrated instances. If not, no action is needed.
- If in use, confirm the exact version and apply Oracle's fix as soon as it is confirmed.
- Restrict access to administrative and cloud management interfaces and review accounts with low privileges.
- Check logs for unusual HTTP activity and re-check NVD and Oracle's advisory for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle October 2026 Critical Patch Update www.oracle.com
- Strix: CVE-2026-101446 www.strix.ai
- Vulners NVD: CVE-2026-101446 vulners.com
- Vulners: CVE-2026-101446 (CVE List) vulners.com
- CVE Brief archive, 25 Oct 2026 cvebrief.com
- Vulners NVD: CVE-2026-101445 (sibling CVE, version discrepancy) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:11.
Original description (NVD)
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Siebel CRM Cloud Applications. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.