Zero Radar
← feed
CriticalVulnerabilityCVE-2026-101446updated 25 Oct 2026, 15:24 UTC

Oracle Siebel CRM Cloud: critical flaw lets low-privileged users take over the system

Someone with a basic user account on the Siebel CRM cloud service could reach across the network and take control of the whole system. That could expose customer data and affect other connected products.

Official, 2 sources
SeverityCriticalCVSS 9.9 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Low-privileged attackerHolds only a basic account
  2. 2HTTP requestSent over the network to the service
  3. 3Siebel Cloud ManagerFlawed component accepts the malicious input
  4. 4System takeoverAttacker gains control of the cloud app
  5. 5Impact spreadsScope change reaches other products
  6. ResultAttacker takes over Siebel CRM Cloud

What happened

A network-reachable flaw in the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications allows a low-privileged attacker to fully compromise the service over HTTP, with scope change to other products.

Why it is dangerous: A successful attack can lead to full takeover of the CRM with high impact on confidentiality, integrity and availability, and can spread to additional connected products. Organizations storing customer records in Siebel CRM Cloud are at risk.

Are you affected?

You are affected if you run Oracle Siebel CRM Cloud Applications in supported versions 17.0 through 26.9.

Oracle Siebel CRM Cloud Applications, supported versions 17.0-26.9 (component: Siebel Cloud Manager)

What to do

  1. Check whether your Siebel CRM Cloud Applications version falls within 17.0-26.9.
  2. Apply the fixed release or official mitigation from Oracle's security advisory as soon as it is available.
  3. Restrict network access to the Siebel Cloud Manager interface and review low-privileged accounts.
  4. Monitor HTTP access logs for unusual requests to Siebel Cloud Manager.

Timeline

  1. 20 Oct 2026, 22:17 UTC
    Publicly disclosed
  2. 20 Oct 2026, 22:17 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 15:24 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-101446 · GHSA-vxxf-qf9x-9c3x
CVSS
9.9 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
20 Oct 2026, 22:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 15:24 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Oracle Siebel CRM Cloud: critical flaw lets low-privileged users take over the system · Zero Radar