Oracle Siebel CRM CVE-2026-101405

Exploitation requires network reachability to the Siebel Apps - Marketing component over HTTPS against affected Oracle Siebel CRM versions 17.0 through 26.9; no authentication (PR:N) and no user interaction (UI:N) are needed. The primary limiting factor is high attack complexity (AC:H): Oracle explicitly labels this 'difficult to exploit,' implying a condition outside the attacker's direct control (e.g., specific server state, timing, or non-default conditions) must be met, which meaningfully reduces reliable exploitation. Oracle's CPU advisory provides no specific feature, protocol, or configuration prerequisite, so the exact triggering condition cannot be named from available data; realistic risk is further bounded to internet-exposed Marketing instances and to only partial (Low) read and update/insert/delete impact with no availability effect.

This is a moderate-severity issue (CVSS 3.1 base 4.8) that in practice sits toward the lower end of real-world priority despite its network, unauthenticated attack surface. The vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N shows a reachable-over-HTTPS, no-privilege, no-interaction flaw, which normally raises concern; however AC:H (Oracle's own 'difficult to exploit' language) and only Low confidentiality and Low integrity impact (no availability impact) substantially temper it. No EPSS score was supplied in the input, there is no CISA KEV listing, and no public exploit code was identified, so the exploitation signal is: no public exploit identified at time of analysis. The conflicting signal to flag explicitly is the input 'Authentication Bypass' tag versus the CVSS, which already encodes PR:N (pre-authentication reachability) and limited partial read/write rather than full account or auth-control takeover - the description does not substantiate a classic authentication bypass, so that tag should be treated with suspicion and verified against Oracle's CPU. Overall: a real but low-urgency Oracle Critical Patch Update item; patch on the normal quarterly cycle rather than as an emergency, prioritizing internet-exposed Siebel Marketing instances.

A remote, unauthenticated attacker reaches an internet-facing Siebel Apps - Marketing instance over HTTPS and sends specially crafted requests that exploit a flaw in the Marketing component. Because attack complexity is high, the attacker likely must satisfy a non-trivial precondition (such as a race or specific server state) before succeeding, after which they gain limited unauthorized read of a subset of data plus partial update/insert/delete on some accessible data. No public exploit code was identified at time of analysis.