Threats affecting pkg:maven/com.oracle/siebel-crm-integration

CVE-2026-87338 is a vulnerability in Oracle Siebel CRM Integration (versions 17.0 through 26.9) that allows an unauthenticated attacker with network access via HTTP to compromise the system. Exploitation requires human interaction by a user other than the attacker. Successful exploitation can lead to unauthorized access to critical data and unauthorized modification (update, insert, delete) of some accessible data. The vulnerability has a CVSS 3.1 base score of 6.9, indicating a medium severity with significant confidentiality and integrity impacts.

CVE-2026-101492 is a medium severity vulnerability in Oracle Siebel CRM Integration (Open Integration component) affecting versions 25.12 through 26.9. It allows an unauthenticated attacker with network access via HTTP to potentially compromise the product. Successful exploitation requires human interaction from a user other than the attacker and can result in unauthorized read, update, insert, or delete access to some Siebel CRM Integration accessible data. The vulnerability also has a scope change, potentially impacting additional products. The CVSS 3.1 base score is 4.7, reflecting limited confidentiality and integrity impacts without availability impact. Oracle has released patches as part of their October 2026 Critical Patch Update advisory.

CVE-2026-70910 is a high-severity vulnerability in Oracle Siebel CRM Integration's REST component affecting versions 17.0 through 26.6. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical or all accessible data within Siebel CRM Integration. The vulnerability has a CVSS 3.1 base score of 7.5, indicating a significant confidentiality impact without requiring privileges or user interaction.

CVE-2026-60796 is a high-severity vulnerability in Oracle Siebel CRM Integration's REST component affecting versions 17.0 through 26.6. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical or all accessible data and to cause a partial denial of service. The vulnerability has a CVSS 3.1 base score of 8.2, indicating high impact on confidentiality and some impact on availability.

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Siebel Server Sync for Exchange). Supported versions that are affected are 17.0-26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel CRM Integration accessible data. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI). Supported versions that are affected are 17.0-26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Integration. Successful attacks of this vulnerability can result in takeover of Siebel CRM Integration. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).