Oracle Siebel CRM CVE-2026-101402

Exploitation targets the Email Marketing component of Oracle Siebel Apps - Marketing (supported versions 17.0 through 26.9) and is performed remotely over HTTP by an unauthenticated attacker (PR:N). The key limiting factor is the AC:H rating: Oracle classifies this as 'difficult to exploit,' implying a required condition such as a specific timing window, race condition, or particular input state that the attacker does not fully control, rather than a simple one-shot request. The impact is bounded to a partial denial of service of the Marketing application only (A:L, S:U) - no data disclosure, no data tampering, and no effect on other Siebel components or the host. Realistic risk is therefore constrained to availability degradation of an internet- or intranet-exposed Siebel Marketing instance.

This is a genuinely low-priority vulnerability despite being network-reachable without authentication. The CVSS 3.1 base score of 3.7 reflects the limiting factors in the vector: AV:N and PR:N/UI:N make it remotely and unauthenticatedly reachable, but AC:H (high attack complexity) means an attacker must win a race condition, defeat a specific precondition, or overcome non-trivial obstacles, and the only impact is A:L - a partial denial of service with no confidentiality (C:N) or integrity (I:N) consequence and no scope change (S:U). No EPSS score was provided in the input, there is no CISA KEV listing, and no public proof-of-concept is referenced, so all three exploitation-likelihood signals are either absent or negative. The signals are internally consistent rather than conflicting: a hard-to-exploit, availability-only flaw in an enterprise CRM module is exactly the kind of high-reachability/low-reward issue that attackers rarely prioritize. The 'unauthenticated' qualifier is confirmed by the CVSS vector (PR:N) and is the only notable aggravating factor; it is tempered by AC:H and the partial, availability-only outcome. Treat this as routine patch-cycle remediation (it ships in the Oracle October 2026 CPU), not an emergency.

A remote attacker with no credentials sends specially crafted HTTP traffic to the internet- or intranet-facing Email Marketing component of Siebel Apps - Marketing, exploiting a condition that under specific timing or input circumstances degrades service availability. The high attack complexity (AC:H) means success is not reliable and likely requires repeated attempts or a specific transient state. No public exploit code is identified at time of analysis, so any attack would require the adversary to independently develop a working trigger.