EUVD-2026-37379Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Siebel Marketing HTTP endpoint
-
DeliverySend crafted unauthenticated HTTP request
-
ExploitExploit Marketing component flaw
-
ExecutionGain application takeover
-
PersistExfiltrate marketing/customer data
-
ImpactPivot to connected Siebel CRM modules
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of Oracle Siebel Apps - Marketing versions 17.0 through 26.5 via HTTP. The only practical limiting factor is network reachability of the Siebel Marketing HTTP interface; deployments where the Marketing component is exposed only on internal segments behind a VPN or reverse proxy with authentication will not be directly exploitable from the internet. No user interaction, no prior authentication, and no non-default configuration is required per the CVSS vector AV:N/AC:L/PR:N/UI:N. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H yields a 9.8 base score representing the highest practical severity - network-reachable, low complexity, no authentication, no user interaction, and complete compromise of all three impact dimensions. EPSS data is not provided in the input, and the CVE is not in CISA KEV at time of analysis, and no POC has been identified, which moderates the immediate exploitation likelihood despite the catastrophic theoretical impact. The Oracle-tagged 'Information Disclosure' label in source intelligence is inconsistent with the full I:H/A:H impact and likely understates the actual risk - Oracle's own description states 'takeover' is achievable. Real-world risk is elevated for any internet-exposed Siebel Marketing deployment; the absence of public exploit code provides only a short window before reverse-engineering of the patch is likely. |
| Exploit ScenarioDerived | An external attacker scans the internet for Oracle Siebel Marketing login portals or component endpoints and sends a crafted HTTP request to the vulnerable Marketing module without supplying any credentials. The request triggers the underlying flaw and yields administrative control over the Siebel Apps - Marketing instance, enabling the attacker to exfiltrate customer marketing databases, tamper with campaign data, or pivot to connected Siebel CRM components. No POC is currently public, but Oracle CPU advisories are routinely analyzed and weaponized by researchers within days to weeks of release. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Remote unauthenticated takeover of Oracle Siebel Apps - Marketing (versions 17.0 through 26.5) is achievable over HTTP, allowing attackers to fully compromise confidentiality, integrity, and availability of the Marketing component. Oracle's CVSS 9.8 rating reflects easy exploitation with no authentication or user interaction required, though no public exploit is identified at time of analysis and the CVE is not currently listed in CISA KEV.
RemediationAI
Apply the Oracle Critical Patch Update from June 2026 as documented at https://www.oracle.com/security-alerts/cspujun2026.html - Patch available per vendor advisory, though Oracle does not publish a single resolved version since CPU patches apply across the supported 17.0-26.5 range. Until patching is complete, restrict network access to the Siebel Marketing web tier by placing it behind a VPN or zero-trust proxy that enforces authentication before HTTP requests reach the application, accepting the trade-off that external marketing campaign management workflows may break. Web application firewall rules blocking anomalous Marketing component endpoints can serve as a secondary control, though without root-cause disclosure these rules will be best-effort pattern matching rather than precise mitigations. Inventory all Siebel Marketing instances including non-production environments, as Oracle CPU vulnerabilities are frequently reverse-engineered from the patch diff within weeks of release.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the Marketing component of Oracle Siebel CRM's Siebel Apps - Marketing product, an enterprise customer relationship management suite widely deployed in financial services, telecommunications, and public sector environments. The affected CPE is cpe:2.3:a:oracle_corporation:siebel_apps_-_marketing covering all releases from 17.0 up to and including 26.5. Although the CWE is not specified, the combination of network-based HTTP attack vector, no privileges required, and full CIA impact is characteristic of authentication bypass, deserialization, or injection flaws commonly seen in Java-based Oracle web applications. Oracle has not publicly disclosed the root cause class, which is consistent with their standard Critical Patch Update disclosure practice.
Know when Siebel Apps Marketing gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle's description states unauthenticated network HTTP exploitation enabling full takeover, justifying AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H and unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing. Successful attacks of this vulnerability can result in takeover of Siebel Apps - Marketing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Siebel Apps - Marketing (versions 17.0-26.5) contains a critical vulnerability enabling unrestricted remote access and complete control of marketing systems without authentication, directly threatening customer data, campaign integrity, and operations continuity. Any organization running affected versions faces extreme risk of data exfiltration, service disruption, and reputational damage. Immediate action is required to isolate systems and prevent unauthorized access.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Isolate affected systems from external networks via strict network segmentation; (2) Implement IP-based access controls limiting connections to authenticated business users only; (3) Deploy Web Application Firewall (WAF) to monitor and block suspicious HTTP traffic; (4) Enable comprehensive audit logging of all authentication, API calls, and administrative actions; (5) Disable remote access unless operationally critical; (6) Monitor continuously for indicators of compromise including unusual data access patterns, failed authentication spikes, and privilege escalation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Siebel Apps Marketing
View allWhen using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a)
Remote takeover of Oracle Siebel CRM's Siebel Apps - Marketing component (versions 17.0 through 26.5) is possible by una
Unauthenticated remote takeover of Oracle Siebel Apps - Marketing (versions 17.0 through 26.5) is possible via HTTP, all
Remote unauthenticated takeover of Oracle Siebel Apps - Marketing (versions 17.0 through 26.5) is possible over HTTP, re
Unauthenticated remote compromise of Oracle Siebel CRM's Siebel Apps - Marketing component (versions 17.0 through 26.6)
Full system takeover in Oracle Siebel CRM's Marketing component is achievable by low-privileged authenticated attackers
Full takeover of Oracle Siebel Apps - Marketing is achievable by any low-privileged attacker with network access via HTT
Authenticated takeover of Oracle Siebel Apps - Marketing (versions 17.0 through 26.5) allows a low-privileged attacker w
Integrity and availability compromise in Oracle Siebel Apps - Marketing (versions 17.0 through 26.6) is reachable by any
Full takeover of Oracle Siebel CRM's Marketing component is achievable by a low-privileged, network-accessible attacker
Local privilege escalation with scope change in Oracle Siebel CRM's Email Marketing component affects versions 17.0 thro
Unauthenticated network exploitation of the Oracle Siebel CRM Marketing component enables critical data theft and unauth
GitHub PoC
Exploit-DB