Oracle Siebel CRM CVE-2026-101467

Requires network access to the Siebel CRM End User Portal Framework over HTTPS; exploitation is unauthenticated (PR:N) and needs no user interaction (UI:N), so any default internet- or intranet-exposed Siebel Portal instance on versions 17.0 through 26.9 is in scope. The primary limiting factor is high attack complexity (AC:H): Oracle rates this 'difficult to exploit,' indicating success depends on specific conditions or state the attacker cannot fully control, which reduces realistic mass-exploitation risk. Impact is confined to Siebel CRM End User-accessible data (confidentiality and integrity); there is no availability impact (A:N) and scope is unchanged (S:U), so no spillover to other components.

This is a genuinely serious but not top-tier-urgent vulnerability. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, base 7.4) describes a network-reachable, unauthenticated flaw (PR:N, no user interaction) with high confidentiality and integrity impact - but the high attack complexity (AC:H) is the key mitigating signal, indicating Oracle itself rates this 'difficult to exploit,' meaning success depends on conditions outside the attacker's direct control rather than a trivially repeatable request. No EPSS score was provided in the input, so real-world exploitation probability cannot be quantified here. There is no CISA KEV listing and no public proof-of-concept in the supplied data, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data (automatable, exploitation, technical impact) was provided. Signal conflict to verify: the input Tags include 'Authentication Bypass,' which is consistent with the PR:N unauthenticated vector but is NOT substantiated by the Oracle-sourced description (which describes unauthorized data read/modify, not an explicit auth-bypass mechanism) - treat the tag as unconfirmed. Net: a real priority for Oracle Siebel operators to patch in the October 2026 CPU cycle, but the AC:H rating and absence of known exploitation argue against emergency out-of-band response.

A remote, unauthenticated attacker sends crafted HTTPS requests to an internet- or intranet-facing Siebel CRM End User Portal Framework endpoint, exploiting the flaw to read and alter critical application data. No public exploit code is known, and the high attack complexity means the attacker must satisfy specific timing or environmental conditions for the attack to succeed reliably.