Oracle Siebel CRM CVE-2026-101391

Exploitation requires a human victim who is a legitimate user of Siebel Apps - Marketing to interact with attacker-supplied content (UI:R) - e.g. clicking a crafted HTTP link or submitting/viewing a page containing the injected payload; the attacker cannot trigger it autonomously. No authentication is required of the attacker (PR:N), but the impact is realized in the victim's authenticated context, so the limiting factors are: the need for user interaction, the requirement that the lured user already have Siebel Marketing access, and impact bounded to a subset of data (C:L/I:L) with no availability loss. The exact vulnerable input/feature in the Marketing component is not specified in the available data.

This is a moderate-severity issue (CVSS 3.1 6.1) whose signals point to a browser-mediated injection flaw (likely reflected cross-site scripting) rather than a server-side compromise. The vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N shows network reachability and no authentication, but exploitation is gated on required user interaction (UI:R), and impacts are only Low confidentiality and Low integrity with no availability impact (A:N) - the scope change (S:C) reflects the attacker's payload executing in a victim's authenticated context/browser rather than on the Siebel server itself. No EPSS probability was supplied in the input, there is no CISA KEV listing, and no public exploit code is referenced, so there is no evidence of active or at-scale exploitation. The practical priority is medium: it is a credible threat against interactive Siebel Marketing users but is not a drive-by, unauthenticated server takeover. NOTE: the input Tag 'Authentication Bypass' conflicts with the CVSS vector and description - this vector (UI:R, S:C, C:L/I:L/A:N) is the textbook Oracle XSS profile and the description never mentions authentication bypass; treat the tag as likely mislabeled and verify the true CWE with Oracle.

An attacker crafts a malicious link or form input containing a script/injection payload and lures an authenticated Siebel Marketing user (via phishing or a planted link) into opening it. When the victim interacts, the payload executes in their session context, letting the attacker read a subset of Siebel-accessible data and perform limited unauthorized update/insert/delete actions as that user, with effects potentially crossing into other products (scope change). No public exploit code is referenced in the input.