Oracle Siebel CRM CVE-2026-101399

Exploitation requires network access to the SMTP-facing functionality of the Oracle Siebel CRM 'Siebel Apps - Marketing' component on an affected version (17.0 through 26.9); the attacker must be able to deliver SMTP/email traffic that the Marketing component processes. No authentication and no user interaction are required (PR:N/UI:N). The key LIMITING factors are: deployments that do not expose the Siebel Marketing SMTP/email-processing interface to untrusted networks are not reachable by remote attackers, and the impact is bounded to a PARTIAL denial of service of the Marketing module only - there is no path to data disclosure, data modification, or full service outage.

This is a moderate-severity, limited-impact issue that is unlikely to be a top patching priority despite the network-facing, unauthenticated vector. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3) confirms a remote, low-complexity, unauthenticated attack over SMTP, but the only consequence is a PARTIAL denial of service (A:L) with no confidentiality or integrity impact (C:N/I:N) - this is a resource/availability degradation, not a system compromise or RCE. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT listed in CISA KEV and no public exploit code is referenced, so there is no public exploit identified at time of analysis. The signals are internally consistent (easy remote vector but capped impact), so there is no CVSS-vs-description conflict to flag; the practical risk is a degraded-availability nuisance rather than a breach vector. Note: EPSS and KEV data are absent from the input rather than confirmed-negative, so the 'no active exploitation' conclusion is based on the absence of a KEV/POC signal and should be revalidated against live threat feeds.

An unauthenticated attacker with network reachability to the Siebel Marketing SMTP interface sends crafted or malformed email/SMTP traffic that the Marketing component mishandles, exhausting or disrupting the service and causing a partial denial of service. No authentication or user interaction is required, but the impact is limited to degraded availability of the Marketing module rather than full outage or data exposure. No public proof-of-concept is referenced in the available data.