Oracle Siebel CRM CVE-2026-101392

Exploitation requires the attacker to already possess a valid low-privileged account with logon access to the infrastructure where Siebel Apps - Marketing executes (CVSS AV:L, PR:L); it is not remotely reachable and needs no user interaction (UI:N). Affected are Siebel CRM Marketing component versions 17.0 through 26.9. The key limiting factors are the local attack vector and the pre-existing authentication requirement, which confine realistic risk to malicious insiders or attackers who have already established a foothold with valid credentials; impact is limited to confidentiality (unauthorized read of Marketing data) with no integrity or availability effect.

Signals point to a moderate, not urgent, priority. The CVSS 3.1 base score is 5.5 (Medium) driven entirely by confidentiality (C:H, I:N, A:N). The vector AV:L/AC:L/PR:L/UI:N establishes that exploitation requires LOCAL access and a valid low-privileged logon to the infrastructure where Siebel Apps - Marketing runs - this is not a remote, unauthenticated issue despite the misleading 'Authentication Bypass' tag, which conflicts with the PR:L vector and should be treated as suspect. There is no CISA KEV listing, no public exploit code identified, and no EPSS score supplied in the input, so there is no evidence of active or at-scale exploitation; the Oracle Critical Patch Update origin (cpuoct2026) indicates a vendor-coordinated disclosure rather than an in-the-wild finding. Net: a real but bounded insider/post-authentication data-disclosure risk that warrants patching on the normal Oracle CPU cadence rather than emergency remediation, with the EPSS and POC signals absent rather than contradictory.

A low-privileged user who already has a valid logon to the host or application environment running Siebel Apps - Marketing leverages the flaw to read Siebel Marketing data they are not authorized to see, potentially exposing all data accessible to the component. Because the vector is local with low complexity and no user interaction, a malicious insider or an attacker who has gained a foothold via stolen low-tier credentials could exploit it reliably. No public proof-of-concept exploit has been identified at the time of analysis.