Siebel Apps Marketing
Monthly
Local privilege escalation with scope change in Oracle Siebel CRM's Email Marketing component affects versions 17.0 through 26.6, confirmed via the Oracle August 2026 Critical Security Update advisory (EUVD-2026-61438). Low-privileged attackers with existing logon access to the Siebel infrastructure can, under difficult-to-reproduce conditions, bypass access controls to read or modify critical marketing data and cascade impacts to other integrated Siebel products. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis.
Unauthenticated network exploitation of the Oracle Siebel CRM Marketing component enables critical data theft and unauthorized modification across all Marketing-accessible records. Tagged explicitly as an Authentication Bypass, the flaw allows a remote attacker with no credentials to compromise the confidentiality and integrity of sensitive CRM marketing data via HTTP, affecting all supported versions from 17.0 through 26.6. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the PR:N/UI:N vector means no user interaction or account is required, making the authentication bypass self-sufficient once the high-complexity exploitation conditions are met.
Integrity and availability compromise in Oracle Siebel Apps - Marketing (versions 17.0 through 26.6) is reachable by any low-privileged, network-authenticated attacker over HTTP with no user interaction required. Successful exploitation allows unauthorized creation, deletion, or modification of critical Marketing data, and can cause a complete denial of service via persistent hang or crash of the Marketing component. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and minimal privilege bar make this a credible threat in environments running unpatched Siebel deployments.
Full takeover of Oracle Siebel Apps - Marketing is achievable by any low-privileged attacker with network access via HTTP, affecting all supported versions from 17.0 through 26.6. The CVSS 3.1 score of 8.8 reflects complete compromise of confidentiality, integrity, and availability, meaning an attacker can read, modify, or destroy data and disrupt service entirely. No public exploit has been identified at time of analysis, but the low attack complexity and minimal privilege bar make this a realistic threat for any internet- or intranet-exposed Siebel Marketing deployment.
Full takeover of Oracle Siebel CRM's Marketing component is achievable by a low-privileged, network-accessible attacker exploiting a difficult-to-trigger condition via HTTP, affecting all supported versions from 17.0 through 26.6. Successful exploitation results in complete confidentiality, integrity, and availability compromise of the Marketing module - effectively a full component takeover. No public exploit code has been identified and the vulnerability is not listed in CISA's KEV catalog; however, Oracle's August 2026 Critical Patch Update confirms the flaw and releases a remediation.
Unauthenticated remote compromise of Oracle Siebel CRM's Siebel Apps - Marketing component (versions 17.0 through 26.6) allows a network attacker over HTTP to read all Marketing-accessible data and to force a complete, repeatable denial of service. The flaw is rated CVSS 3.1 9.1 and is tagged as an authentication bypass, meaning no credentials are required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of no authentication, low attack complexity, and high confidentiality/availability impact makes it a high-priority patch.
Unauthorized data disclosure and partial service disruption affect Oracle Siebel CRM's Marketing component across versions 17.0 through 26.6, exploitable by a low-privileged authenticated attacker via HTTP without requiring user interaction. The flaw enables complete read access to all data within the Siebel Apps - Marketing scope alongside degraded service availability, as confirmed by Oracle's August 2026 Critical Security Patch Update. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in CISA's Known Exploited Vulnerabilities catalog.
Full system takeover in Oracle Siebel CRM's Marketing component is achievable by low-privileged authenticated attackers over HTTP across all versions 17.0 through 26.6. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity with no user interaction required, yielding complete confidentiality, integrity, and availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the straightforward exploitation conditions and full-triad impact make this a high-priority patch target for any organization running exposed Siebel Marketing instances.
Remote takeover of Oracle Siebel CRM's Siebel Apps - Marketing component (versions 17.0 through 26.5) is possible by unauthenticated attackers reaching the application over HTTP, per Oracle's June 2026 Critical Patch Update. With a 9.8 CVSS base score and full confidentiality/integrity/availability impact, this represents a top-priority Oracle CPU finding, though no public exploit identified at time of analysis and the issue is not currently listed in CISA KEV.
Unauthenticated remote takeover of Oracle Siebel Apps - Marketing (versions 17.0 through 26.5) is possible via HTTP, allowing attackers to fully compromise confidentiality, integrity, and availability of the marketing component. Oracle's CVSS 3.1 base score of 9.8 reflects trivial network exploitability with no authentication or user interaction, and no public exploit identified at time of analysis. The flaw was disclosed in Oracle's Critical Patch Update cycle and tracked in ENISA's EUVD as EUVD-2026-37381.
Remote unauthenticated takeover of Oracle Siebel Apps - Marketing (versions 17.0 through 26.5) is achievable over HTTP, allowing attackers to fully compromise confidentiality, integrity, and availability of the Marketing component. Oracle's CVSS 9.8 rating reflects easy exploitation with no authentication or user interaction required, though no public exploit is identified at time of analysis and the CVE is not currently listed in CISA KEV.
Authenticated takeover of Oracle Siebel Apps - Marketing (versions 17.0 through 26.5) allows a low-privileged attacker with HTTP network access to fully compromise confidentiality, integrity, and availability of the Marketing component. Oracle rates this 8.8 CVSS 3.1 with low attack complexity and no user interaction, making it an easy-win post-authentication vulnerability against any reachable Siebel Marketing instance. No public exploit identified at time of analysis, and the issue is not on the CISA KEV list.
Remote unauthenticated takeover of Oracle Siebel Apps - Marketing (versions 17.0 through 26.5) is possible over HTTP, requiring no privileges or user interaction. Successful exploitation yields full compromise of the Marketing component with high confidentiality, integrity, and availability impact (CVSS 9.8). No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server;. Rated high severity (CVSS 7.0). This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required.
Local privilege escalation with scope change in Oracle Siebel CRM's Email Marketing component affects versions 17.0 through 26.6, confirmed via the Oracle August 2026 Critical Security Update advisory (EUVD-2026-61438). Low-privileged attackers with existing logon access to the Siebel infrastructure can, under difficult-to-reproduce conditions, bypass access controls to read or modify critical marketing data and cascade impacts to other integrated Siebel products. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis.
Unauthenticated network exploitation of the Oracle Siebel CRM Marketing component enables critical data theft and unauthorized modification across all Marketing-accessible records. Tagged explicitly as an Authentication Bypass, the flaw allows a remote attacker with no credentials to compromise the confidentiality and integrity of sensitive CRM marketing data via HTTP, affecting all supported versions from 17.0 through 26.6. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the PR:N/UI:N vector means no user interaction or account is required, making the authentication bypass self-sufficient once the high-complexity exploitation conditions are met.
Integrity and availability compromise in Oracle Siebel Apps - Marketing (versions 17.0 through 26.6) is reachable by any low-privileged, network-authenticated attacker over HTTP with no user interaction required. Successful exploitation allows unauthorized creation, deletion, or modification of critical Marketing data, and can cause a complete denial of service via persistent hang or crash of the Marketing component. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and minimal privilege bar make this a credible threat in environments running unpatched Siebel deployments.
Full takeover of Oracle Siebel Apps - Marketing is achievable by any low-privileged attacker with network access via HTTP, affecting all supported versions from 17.0 through 26.6. The CVSS 3.1 score of 8.8 reflects complete compromise of confidentiality, integrity, and availability, meaning an attacker can read, modify, or destroy data and disrupt service entirely. No public exploit has been identified at time of analysis, but the low attack complexity and minimal privilege bar make this a realistic threat for any internet- or intranet-exposed Siebel Marketing deployment.
Full takeover of Oracle Siebel CRM's Marketing component is achievable by a low-privileged, network-accessible attacker exploiting a difficult-to-trigger condition via HTTP, affecting all supported versions from 17.0 through 26.6. Successful exploitation results in complete confidentiality, integrity, and availability compromise of the Marketing module - effectively a full component takeover. No public exploit code has been identified and the vulnerability is not listed in CISA's KEV catalog; however, Oracle's August 2026 Critical Patch Update confirms the flaw and releases a remediation.
Unauthenticated remote compromise of Oracle Siebel CRM's Siebel Apps - Marketing component (versions 17.0 through 26.6) allows a network attacker over HTTP to read all Marketing-accessible data and to force a complete, repeatable denial of service. The flaw is rated CVSS 3.1 9.1 and is tagged as an authentication bypass, meaning no credentials are required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of no authentication, low attack complexity, and high confidentiality/availability impact makes it a high-priority patch.
Unauthorized data disclosure and partial service disruption affect Oracle Siebel CRM's Marketing component across versions 17.0 through 26.6, exploitable by a low-privileged authenticated attacker via HTTP without requiring user interaction. The flaw enables complete read access to all data within the Siebel Apps - Marketing scope alongside degraded service availability, as confirmed by Oracle's August 2026 Critical Security Patch Update. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in CISA's Known Exploited Vulnerabilities catalog.
Full system takeover in Oracle Siebel CRM's Marketing component is achievable by low-privileged authenticated attackers over HTTP across all versions 17.0 through 26.6. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity with no user interaction required, yielding complete confidentiality, integrity, and availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the straightforward exploitation conditions and full-triad impact make this a high-priority patch target for any organization running exposed Siebel Marketing instances.
Remote takeover of Oracle Siebel CRM's Siebel Apps - Marketing component (versions 17.0 through 26.5) is possible by unauthenticated attackers reaching the application over HTTP, per Oracle's June 2026 Critical Patch Update. With a 9.8 CVSS base score and full confidentiality/integrity/availability impact, this represents a top-priority Oracle CPU finding, though no public exploit identified at time of analysis and the issue is not currently listed in CISA KEV.
Unauthenticated remote takeover of Oracle Siebel Apps - Marketing (versions 17.0 through 26.5) is possible via HTTP, allowing attackers to fully compromise confidentiality, integrity, and availability of the marketing component. Oracle's CVSS 3.1 base score of 9.8 reflects trivial network exploitability with no authentication or user interaction, and no public exploit identified at time of analysis. The flaw was disclosed in Oracle's Critical Patch Update cycle and tracked in ENISA's EUVD as EUVD-2026-37381.
Remote unauthenticated takeover of Oracle Siebel Apps - Marketing (versions 17.0 through 26.5) is achievable over HTTP, allowing attackers to fully compromise confidentiality, integrity, and availability of the Marketing component. Oracle's CVSS 9.8 rating reflects easy exploitation with no authentication or user interaction required, though no public exploit is identified at time of analysis and the CVE is not currently listed in CISA KEV.
Authenticated takeover of Oracle Siebel Apps - Marketing (versions 17.0 through 26.5) allows a low-privileged attacker with HTTP network access to fully compromise confidentiality, integrity, and availability of the Marketing component. Oracle rates this 8.8 CVSS 3.1 with low attack complexity and no user interaction, making it an easy-win post-authentication vulnerability against any reachable Siebel Marketing instance. No public exploit identified at time of analysis, and the issue is not on the CISA KEV list.
Remote unauthenticated takeover of Oracle Siebel Apps - Marketing (versions 17.0 through 26.5) is possible over HTTP, requiring no privileges or user interaction. Successful exploitation yields full compromise of the Marketing component with high confidentiality, integrity, and availability impact (CVSS 9.8). No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server;. Rated high severity (CVSS 7.0). This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required.