CVE-2026-101438: High severity Oracle Siebel CRM Cloud Applications vulnerability
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications. While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM Cloud Applications accessible data as well as unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 8.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).
Affected Software
Event History
Frequently Asked Questions
Who can realistically exploit this issue?
An attacker does not need authentication, but must have access to the physical communication segment connected to the hardware running Siebel CRM Cloud Applications. Exploitation is rated difficult, indicating additional conditions or effort are required beyond network adjacency.
Which deployments are identified as affected?
Affected supported versions are 22.3 through 26.9, and the affected component is Siebel Cloud Manager. The provided information does not state whether any particular default configuration changes exposure.
What could a successful attacker do?
A successful attack can provide unauthorized access to critical data or all data accessible to Siebel CRM Cloud Applications, and can allow creation, deletion, or modification of that data. The scope may extend to additional products beyond the vulnerable application.
What should be prioritized if remediation cannot happen immediately?
Restrict access to the physical communication segment attached to the hardware running the application, since that access is required for exploitation. The provided information does not specify a workaround or compensating control beyond limiting this access.