Siebel CRM CVE-2026-101463

Exploitation requires network reachability to the Siebel CRM End User web interface exposing the UIF Open UI component over HTTP; per CVSS PR:N/UI:N/AC:L, no authentication, no user interaction, and no non-default configuration are required against affected builds (17.0 through 26.9). The primary limiting factors are therefore exposure-based rather than privilege-based: the Siebel Open UI endpoint must be reachable by the attacker (direct internet exposure, VPN, or internal network foothold), and the instance must be an unpatched version within 17.0-26.9. Impact is confined to unauthorized reading of Siebel-accessible data (C:H, I:N, A:N) - the flaw does not permit data modification or service disruption.

This is a genuinely notable issue but not a top-tier emergency based on available signals. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation over HTTP with no user interaction, which is the most dangerous combination of access conditions. However, impact is scoped to confidentiality only (C:H/I:N/A:N, S:U), capping the base score at 7.5 (High) - there is no integrity tampering or availability/denial-of-service component, so this is a data-disclosure flaw rather than a system-takeover flaw. No EPSS probability, no CISA KEV listing, and no public POC were provided in the input, so there is no evidence of active or imminent exploitation at this time; the only reference is the Oracle October 2026 Critical Patch Update. No SSVC decision data was supplied. Conflict to verify: the input Tags include 'Authentication Bypass,' but the description characterizes this as unauthenticated access to data (PR:N) rather than a bypass of an authentication control protecting authenticated functionality - these are distinct, and the tag may overstate the mechanism; treat the 'auth bypass' framing as unconfirmed pending Oracle's advisory detail. Net: a real patch-this-cycle priority for Siebel operators given unauthenticated network reach, but the confidentiality-only impact and absence of exploitation signals place it below worm-able RCE-class issues.

A remote attacker with no credentials sends a crafted HTTP request to the internet- or intranet-exposed Siebel CRM End User interface (UIF Open UI component), exploiting the flaw to retrieve data they should not be able to access. Because AC:L and PR:N/UI:N apply, no special timing, social engineering, or prior access is needed, and a single request can return critical Siebel CRM data. No public exploit code was identified in the provided data, so any current exploitation would require independent research by the attacker.