Oracle Siebel CRM CVE-2026-101394

Requires a network-reachable Siebel Apps - Marketing instance exposed over HTTP; per AV:N/AC:L/PR:N/UI:N no authentication, special privileges, or user interaction are needed, so default internet-facing deployments of affected versions (17.0 through 26.9) are exploitable. Exploitation is LIMITED in effect rather than in access: the flaw grants only partial integrity impact (unauthorized update/insert/delete to SOME accessible data) with no confidentiality or availability consequences, and exposure is further reduced where the Marketing component is not reachable from untrusted networks (internal-only, VPN-gated, or WAF-fronted deployments).

This is a moderate-severity integrity-only issue that should be prioritized as routine patching rather than an emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) indicates an unauthenticated, network-reachable, low-complexity attack with no user interaction - favorable conditions for an attacker - but the impact is constrained to LOW integrity only (C:N, A:N), meaning an attacker can perform unauthorized update, insert, or delete on SOME accessible Marketing data without any confidentiality or availability loss. No EPSS score was supplied in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public exploit (POC) referenced, so the exploitation status is no public exploit identified at time of analysis - do not treat this as actively exploited. The only vendor signal is the Oracle Critical Patch Update (October 2026), consistent with coordinated disclosure rather than observed in-the-wild activity. Net: the easy-access vector raises baseline exposure for internet-facing Siebel Marketing instances, but the limited (partial integrity) impact keeps real-world risk in the medium band. Note one metadata caveat - the input carries an 'Authentication Bypass' tag, yet the description and PR:N simply describe an inherently unauthenticated flaw affecting some data, not a documented authentication-bypass technique; verify the tag against the Oracle advisory.

An attacker with only network access sends crafted HTTP requests to an internet-reachable Siebel Apps - Marketing endpoint and, without authenticating, modifies, inserts, or deletes a subset of Marketing data (for example tampering with campaign or list records). No public exploit code is referenced, so an attacker would need to develop the request independently, but the low attack complexity and absence of required privileges or user interaction make this straightforward once the flaw is understood.