CVE-2026-101446 is a critical (CVSS 9.9) vulnerability in the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications. A low-privileged attacker with network access can use it to take over the application.
What Is It
CVE-2026-101446 is a flaw in the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications. According to Oracle's description, the vulnerability is easily exploitable. An attacker with low privileges and network access over HTTP can use it to compromise Siebel CRM Cloud Applications.
Oracle rates it CVSS 3.1 base score 9.9 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. In practice, that means:
- Attack vector: Network
- Attack complexity: Low
- Privileges required: Low
- User interaction: None
- Scope: Changed
- Impact: High confidentiality, integrity and availability
NVD published the record on 2026-10-20. Its current status is "Received."
Why It Matters
A successful attack can take over Siebel CRM Cloud Applications. Because the scope is changed, Oracle notes that an attack may also significantly affect other products beyond the vulnerable component. The bar for exploitation is low: one low-privileged account, network reachability over HTTP and no user interaction. That makes any exposed or internally reachable Cloud Manager instance a priority.
CVE-2026-101446 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied data does not confirm active exploitation. Watch the KEV catalog for changes.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Siebel CRM Cloud Applications (Oracle Siebel CRM)
- Component: Siebel Cloud Manager
- Affected versions: 17.0 through 26.9 (supported versions)
NVD has not listed any affected CPEs yet.
Patch Status
Oracle's reference for this CVE is the October 2026 Critical Patch Update (CPU) advisory. The supplied records do not name specific fixed versions. Organizations running Siebel CRM Cloud Applications 17.0–26.9 should:
- Review the October 2026 CPU advisory and apply Oracle's guidance for Siebel Cloud Manager.
- Limit HTTP access to Siebel Cloud Manager to trusted networks until patches are applied.
- Audit low-privileged accounts that can reach the component.
There is no CISA KEV entry, so no federal required action or due date applies at this time.
Sources
- NVD, CVE-2026-101446
- Oracle Critical Patch Update Advisory; October 2026
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE as of publication)