CVE-2026-101451: CSRF
Vulnerability in the Siebel Life Sciences product of Oracle Siebel CRM (component: Web UI). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Life Sciences. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel Life Sciences, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel Life Sciences accessible data as well as unauthorized access to critical data or complete access to all Siebel Life Sciences accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs network access to the affected Siebel Life Sciences Web UI over HTTP and must have low-level privileges. Exploitation also requires interaction by a person other than the attacker.
Which deployments are affected?
Affected supported versions are 17.0 through 26.9 of Oracle Siebel Life Sciences. The provided information identifies the Web UI component, but does not state whether any particular default configuration is affected.
What could happen if exploitation succeeds?
An attacker may gain unauthorized access to critical data or all data accessible through Siebel Life Sciences, and may create, modify, or delete that data. The impact can also significantly affect additional products because the vulnerability has scope change.