# CVE-2026-101392: Oracle Siebel CRM Apps - Marketing data disclosure

Source: https://junglewise.ai/threats/cve-2026-101392-vulnerability-in-the-siebel-apps-marketing-product-of-oracle  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-101392 · Severity: medium · CVSS 5.5 · Published 2026-10-20

Oracle Siebel CRM's Marketing module contains a vulnerability that allows a low-privileged user with local access to the server to read sensitive customer and campaign data. An attacker with employee or contractor access to the infrastructure could gain unauthorized access to critical business information stored in the marketing application, compromising customer privacy and competitive data.

Technologies: [Oracle Siebel CRM Apps Marketing](https://junglewise.ai/threats/technologies/siebel-crm-apps-marketing). Vendors: [Oracle](https://junglewise.ai/threats/vendors/oracle).

## Quick answers

**Is CVE-2026-101392 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-101392 being exploited in the wild.

**How severe is CVE-2026-101392?** Medium severity, with a CVSS score of 5.5, published 20 October 2026.

**Which products and versions are affected?** Oracle Siebel CRM Apps Marketing 17.0–26.9.

**Is there a fix for CVE-2026-101392?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-101392 attacked?** It is attacked with local access, in a hosted service.

**Am I affected by CVE-2026-101392?** Check whether you run Oracle Siebel CRM Apps Marketing at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A local privilege escalation or information disclosure vulnerability in the Siebel Apps - Marketing component allows a low-privileged local attacker to read sensitive data without requiring elevated privileges. The vulnerability is easily exploitable via direct local access to the infrastructure where Siebel executes, with no user interaction required. Exploitation results in confidentiality breach of all marketing-related data accessible through the application.

## Affected products

- Oracle Siebel CRM Apps - Marketing 17.0–26.9

## Timeline

- 2026-10-20: disclosed

## References

- [https://www.oracle.com/security-alerts/cpuoct2026.html](https://www.oracle.com/security-alerts/cpuoct2026.html)

## Related threats

- [Oracle Siebel CRM Apps - Marketing partial denial of service via SMTP](https://junglewise.ai/threats/cve-2026-101399-vulnerability-in-the-siebel-apps-marketing-product-of-oracle)
- [Oracle Siebel CRM Apps Marketing privilege escalation](https://junglewise.ai/threats/cve-2026-73966-oracle-siebel-crm-apps-marketing-privilege-escalation)