Oracle Siebel CRM CVE-2026-101406

Exploitation requires network HTTP access to the Siebel Apps - Marketing component of Oracle Siebel CRM (supported versions 17.0 through 26.9); no authentication or user interaction is needed (PR:N/UI:N). The primary limiting factor is the high attack complexity (AC:H): Oracle explicitly describes this as 'difficult to exploit,' implying the attacker must satisfy specific conditions or win a race/state dependency outside their direct control, making reliable exploitation hard. Impact is confined to read access to only a subset of accessible Marketing data (C:L); there is no integrity or availability impact. No non-default feature or configuration setting is named in the description as a prerequisite.

This is a genuinely low-priority issue despite being unauthenticated. The CVSS 3.1 base score of 3.7 (LOW) is driven by AV:N/AC:H/PR:N/UI:N with only C:L (no integrity or availability impact), meaning a network-reachable, unauthenticated attacker can obtain unauthorized read access to a subset of Siebel Apps - Marketing data - but only after overcoming significant exploitation difficulty (AC:H). Oracle itself labels it 'difficult to exploit,' consistent with AC:H. No EPSS score was provided in the input, so exploitation probability cannot be quantified. It is NOT listed in CISA KEV and no public POC was identified, so there is no evidence of active or imminent exploitation. The signals are internally consistent: a high attack complexity plus low confidentiality-only impact plus no exploitation evidence all point to a low real-world priority rather than a high-CVSS-but-overrated issue. The only elevating factor is the lack of required authentication (PR:N). Note a metadata conflict: the input Tags include 'Authentication Bypass,' yet the description describes unauthorized read access to a data subset - an information-disclosure flaw, not an authentication bypass - so the tag appears mislabeled and should be verified against Oracle's advisory.

A remote, unauthenticated attacker with HTTP network access to a Siebel Apps - Marketing instance crafts a series of specially constructed requests that, under specific and hard-to-reproduce conditions (AC:H), cause the application to disclose a subset of otherwise-protected marketing data. No public exploit code was identified, and the high attack complexity means successful exploitation is unlikely to be reliable or widespread.