Oracle Siebel CRM CVE-2026-101397

Exploitation requires an authenticated attacker holding HIGH privileges within Siebel Apps - Marketing (CVSS PR:H) and succeeds only over HTTP against the Marketing component in versions 17.0-26.9. Exploitation is further LIMITED by high attack complexity (AC:H), meaning additional conditions outside the attacker's control (e.g., specific state, timing, or configuration) must be met; no user interaction is needed (UI:N). Impact is confined to unauthorized read of a subset of Marketing-accessible data - no write/integrity or availability effect. The high privilege and high complexity together sharply narrow realistic exploitation to privileged insiders or post-compromise attackers.

This is a genuinely low-priority issue despite being network-reachable. The CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N, base 2.2) describes a high-complexity attack requiring an already high-privileged account, yielding only limited confidentiality impact (read access to a subset of Marketing data) with no integrity or availability effect. No EPSS score was provided; the CVE is not in CISA KEV and no public exploit was identified, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision was supplied. The combination of AC:H and PR:H means an attacker must already hold a privileged Siebel account AND overcome additional preconditions, making opportunistic or automated exploitation unlikely. CONFLICT TO NOTE: the input carries an 'Authentication Bypass' tag, which directly contradicts the CVSS PR:H (high privilege required) and the description ('high privileged attacker') - this tag appears mislabeled and should not be used to escalate priority. Net: a legitimately low-severity, low-real-risk information-disclosure flaw, not an urgent priority absent KEV/POC/EPSS signals.

An attacker who has already obtained a high-privilege Siebel Apps - Marketing account sends crafted HTTP requests to the Marketing component and, after satisfying additional non-trivial conditions (reflected by AC:H), reads a limited subset of data they should not be able to access. No public proof-of-concept exists, and the high complexity plus high privilege requirement make this a post-compromise or insider scenario rather than a remote break-in.