EUVD-2026-37378Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged Siebel credentials
-
DeliveryReach Marketing web tier over HTTP
-
ExploitSend crafted authenticated request
-
ExecutionTrigger Marketing component flaw
-
PersistTake over Marketing module
-
ImpactExfiltrate customer data and tamper with campaigns
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must have network HTTP/HTTPS reach to a running Siebel Apps - Marketing instance on a supported version between 17.0 and 26.5, and must hold valid low-privileged Siebel credentials (PR:L in the CVSS vector) - fully unauthenticated exploitation is not indicated. No user interaction is required (UI:N) and attack complexity is low (AC:L), so any reachable Marketing endpoint with at least one compromised low-privileged account is sufficient; what limits exploitation is the credential requirement, the need for the Marketing module to be deployed and reachable (it is not always exposed to the public internet in typical Siebel architectures), and being on an affected unpatched version. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H produces a high 8.8 score and credibly reflects real risk: any user holding even minimal Siebel credentials on a network-reachable Marketing instance can fully take over the component without user interaction. There is no EPSS score, KEV listing, or public POC provided in the input, so widespread opportunistic exploitation looks unlikely in the very near term, but Oracle Siebel deployments are high-value targets (customer PII, marketing data, integration credentials) and Oracle CPU advisories are routinely reverse-engineered after release. The Oracle-only disclosure is sparse: no CWE, no patched version string in the input, and no technical root-cause detail, so defenders must treat 'takeover' as worst-case full RCE/data compromise of the Marketing component until Oracle's advisory text is read in full. Note that the Tags field includes 'Information Disclosure' but the CVSS vector marks all three impacts High, which is a mild conflict - trust the CVSS impacts over the tag. |
| Exploit ScenarioDerived | An attacker who has obtained any low-privileged Siebel account - through phishing, credential reuse, or an insider - sends crafted HTTP requests to the Siebel Marketing web interface and abuses the flaw to escalate to full control of the Marketing component, exfiltrating customer marketing data and tampering with campaigns. No public exploit is identified at time of analysis, but Oracle CPU vulnerabilities are commonly analyzed and weaponized once the patches are diffed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Authenticated takeover of Oracle Siebel Apps - Marketing (versions 17.0 through 26.5) allows a low-privileged attacker with HTTP network access to fully compromise confidentiality, integrity, and availability of the Marketing component. Oracle rates this 8.8 CVSS 3.1 with low attack complexity and no user interaction, making it an easy-win post-authentication vulnerability against any reachable Siebel Marketing instance. No public exploit identified at time of analysis, and the issue is not on the CISA KEV list.
RemediationAI
Patch available per vendor advisory: apply the fixes shipped in the Oracle Critical Patch Update of June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html) for every Siebel Apps - Marketing instance in the 17.0-26.5 range - the input does not contain an exact fixed version string, so consult the CPU patch matrix for the precise patchset for each running release. Until patching, reduce exposure by restricting network reachability of the Siebel Marketing web tier to trusted corporate networks or a VPN (trade-off: breaks remote marketing user access), tightening Siebel role/responsibility assignments so fewer accounts hold even low Marketing privileges (trade-off: may block legitimate campaign work), and increasing monitoring of authenticated Marketing HTTP requests and Siebel audit logs for anomalous activity (trade-off: detective, not preventive). Disabling the Marketing module entirely is an option only where it is unused, as it will halt campaign and segmentation functionality.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Siebel CRM is an enterprise customer relationship management suite; the Marketing module (Siebel Apps - Marketing) handles campaign management, segmentation, and outbound marketing workflows, typically exposed through a web tier that authenticates Siebel users over HTTP/HTTPS. The CPE cpe:2.3:a:oracle_corporation:siebel_apps_-_marketing covers all supported releases from 17.0 up to and including 26.5, indicating a long-lived flaw in shared Marketing component code rather than a regression in a single release. No CWE was assigned by Oracle (consistent with Oracle's Critical Patch Update style of minimal technical disclosure), but the combination of network vector, low privileges, low complexity, and full CIA impact described as 'takeover' is characteristic of authorization bypass, insecure deserialization, or server-side injection in an authenticated web interface.
Know when Siebel Apps Marketing gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network HTTP vector, low complexity, requires a low-privileged Siebel account (PR:L), no user interaction, and vendor describes full component takeover so C/I/A all High.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Apps - Marketing. Successful attacks of this vulnerability can result in takeover of Siebel Apps - Marketing. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Siebel Marketing (versions 17.0-26.5) contains a high-severity vulnerability allowing any low-privileged Siebel user to seize complete control of customer data, campaigns, and system operations. No public exploit code has been identified, but the ease of attack post-authentication creates an elevated insider threat and potential escalation vector for external attackers with compromised credentials. The lack of available patches necessitates immediate defensive controls.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) implement network-layer access controls restricting Siebel Marketing to whitelisted IP ranges and subnets; (2) enforce principle of least privilege with minimal required user roles and disable unnecessary administrative accounts; (3) deploy continuous audit logging with real-time alerting for suspicious administrative activities, data exports, or configuration changes; (4) evaluate operational viability of temporarily disabling the Marketing module; (5) establish network segmentation isolating Siebel infrastructure from general corporate networks and east-west traffic.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Siebel Apps Marketing
View allWhen using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a)
Remote takeover of Oracle Siebel CRM's Siebel Apps - Marketing component (versions 17.0 through 26.5) is possible by una
Unauthenticated remote takeover of Oracle Siebel Apps - Marketing (versions 17.0 through 26.5) is possible via HTTP, all
Remote unauthenticated takeover of Oracle Siebel Apps - Marketing (versions 17.0 through 26.5) is achievable over HTTP,
Remote unauthenticated takeover of Oracle Siebel Apps - Marketing (versions 17.0 through 26.5) is possible over HTTP, re
Unauthenticated remote compromise of Oracle Siebel CRM's Siebel Apps - Marketing component (versions 17.0 through 26.6)
Full system takeover in Oracle Siebel CRM's Marketing component is achievable by low-privileged authenticated attackers
Full takeover of Oracle Siebel Apps - Marketing is achievable by any low-privileged attacker with network access via HTT
Integrity and availability compromise in Oracle Siebel Apps - Marketing (versions 17.0 through 26.6) is reachable by any
Full takeover of Oracle Siebel CRM's Marketing component is achievable by a low-privileged, network-accessible attacker
Local privilege escalation with scope change in Oracle Siebel CRM's Email Marketing component affects versions 17.0 thro
Unauthenticated network exploitation of the Oracle Siebel CRM Marketing component enables critical data theft and unauth
GitHub PoC
Exploit-DB