Oracle Siebel CRM Deployment: Vulnerability in Server Infrastructure
Summary
Oracle Siebel CRM Deployment versions 17.0 through 26.9 contain a vulnerability in the Server Infrastructure component. An attacker with a low-privileged account and network access via HTTP can create, modify or delete data, access critical data and partly disrupt the service. No user interaction is required. Oracle rates the issue CVSS 3.1 8.3 (High); the CWE classification is still being verified.
Affected
- Siebel CRM Deployment 17.0 up to and including 26.9
- Note: a Tenable plugin refers to versions up to 26.8. Verify the exact range in Oracle's advisory.
Fixed in
Unknown. The fixed build is not confirmed in the sources available. Check the Oracle October 2026 CPU advisory for the patch ID and fixed release.
Workaround
- No vendor-documented workaround is known.
- Generic interim measure, not confirmed by Oracle for this CVE: restrict external HTTP access to the Siebel server to trusted IP addresses or internal network segments.
Exploitation
- No public exploit is available according to VulDB.
- No exploitation in the wild has been found.
- CISA SSVC: exploitation none, not automatable, partial technical impact.
Our recommendation
- Confirm whether Siebel CRM Deployment 17.0 to 26.9 is in use.
- Check whether the HTTP interface is reachable from the internet, partner or guest networks, and restrict access to trusted networks.
- Apply the Oracle October 2026 CPU patch once the fixed build is confirmed.
- Review low-privileged accounts and monitor the application for unusual activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update October 2026 www.oracle.com
- VulDB entry 423134 vuldb.com
- Vulners CVE record CVE-2026-101459 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:33.
Original description (NVD)
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Siebel CRM Deployment. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.