Oracle Siebel Life Sciences: Vulnerability in Web UI allows data compromise
Summary
Oracle Siebel Life Sciences, part of Oracle Siebel CRM, contains a vulnerability in the Web UI component that is reachable over HTTP. An attacker with a low-privilege account and network access can, if another person interacts, create, modify or delete critical data and gain access to all data accessible to Siebel Life Sciences. The CNA rates it CVSS 3.1 8.7 (High); the impact is on confidentiality and integrity, not availability. No public exploit or evidence of active exploitation was found.
Affected
- Oracle Siebel Life Sciences, versions 17.0 to 26.9 (CNA record)
- Discrepancy: a Tenable plugin title cites Siebel Server <= 26.8; verify exact builds with Oracle
Fixed in
Unknown. Check the Oracle October 2026 CPU advisory (Rev 2 or later) for the patch numbers.
Workaround
Unknown. No vendor mitigation was found; check the Oracle advisory.
Exploitation
- No evidence of exploitation in the wild found; CISA KEV not verified directly
- No public proof-of-concept found
- EPSS 0.00324 (low)
- VulDB gives CVSS 5.5 and CWE-269; the CNA score of 8.7 is used here
Our recommendation
- Check whether Siebel Life Sciences is used in your environment or by clients or partners; if not, no action is needed.
- If used, apply the Oracle October 2026 CPU patch together with CVE-2026-101457.
- Restrict access to the Siebel web interface to known networks and check whether it is exposed to the internet.
- Review accounts with low privileges and monitor for unusual record changes.
- Re-check NVD and CISA KEV for status changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update Advisory October 2026 www.oracle.com
- CVE-2026-101451 at vulners (CVE record copy) vulners.com
- CVE-2026-101451 at Strix (CVSS 3.1 vector) www.strix.ai
- VulDB entry 423153 vuldb.com
- Brandefense: Oracle October 2026 CPU brandefense.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:21.
Original description (NVD)
Vulnerability in the Siebel Life Sciences product of Oracle Siebel CRM (component: Web UI). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Life Sciences. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel Life Sciences, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel Life Sciences accessible data as well as unauthorized access to critical data or complete access to all Siebel Life Sciences accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.