Oracle Siebel CRM Deployment: Unauthenticated data access and modification via HTTP
Summary
A flaw in the Server Infrastructure component of Oracle Siebel CRM Deployment, versions 17.0 through 26.9, can be exploited by an unauthenticated attacker with network access via HTTP. A successful attack can grant unauthorized read access to critical data, including all data accessible to the application, and unauthorized update, insert or delete access to some of that data. Availability is not affected according to the CNA, and no exploitation or public proof of concept has been found so far.
Affected
- Oracle Siebel CRM Deployment, Server Infrastructure component, versions 17.0 through 26.9 (per CNA record)
Fixed in
- Fixed in the Oracle Critical Patch Update of October 2026. Exact patch identifier and fixed build: Unknown. Check Oracle's advisory for the patch for your release line.
Workaround
- No vendor-confirmed workaround. Unknown.
- Until patched, restrict HTTP access to the Siebel environment to trusted administrative subnets using firewall rules or network segmentation.
Exploitation
- No evidence of exploitation in the wild found. CISA KEV status not verified.
- No public proof of concept found.
- EPSS 0.00339 (low predicted exploitation probability).
Our recommendation
- Check whether Siebel CRM Deployment 17.0 to 26.9 is installed. If not, no action is needed.
- Remove any direct internet exposure of the Siebel HTTP service now.
- Apply the October 2026 Oracle patch for your release line after confirming the correct patch in Oracle's advisory.
- Review web and application logs for unusual read or write activity, as no login is required to reach the service.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update Advisory - October 2026 www.oracle.com
- CVE record via Vulners (CNA data) vulners.com
- Strix CVE summary www.strix.ai
- Vulners PT-2026-119146 (Oracle CPU reference) vulners.com
- Vulners CNNVD-2026-71175463 (EPSS) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:33.
Original description (NVD)
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data as well as unauthorized update, insert or delete access to some of Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.