SB20261107274 - Multiple vulnerabilities in Siebel CRM Integration
Published: November 7, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 vulnerabilities.
1) Improper input validation (CVE-ID: CVE-2026-47016)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 1 [CVSS:4.0/AV:P/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged user to gain access to sensitive information.
The vulnerability exists due to improper input validation within the Event Publish and Subscribe component in Siebel CRM Integration. A local privileged user can exploit this vulnerability to gain access to sensitive information.
2) Improper input validation (CVE-ID: CVE-2026-60357)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote non-authenticated attacker to manipulate data.
The vulnerability exists due to improper input validation within the Siebel Server Sync for Exchange component in Siebel CRM Integration. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.
3) Improper Certificate Validation (CVE-ID: CVE-2026-34500)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass client certificate authentication.
The vulnerability exists due to improper certificate validation in CLIENT_CERT authentication when processing OCSP checks with FFM and soft-fail disabled. A remote user can present a certificate in affected scenarios to bypass client certificate authentication.
Only some scenarios using FFM are affected.
4) Race condition (CVE-ID: CVE-2025-12383)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass trust restrictions.
The vulnerability exists due to a race condition in the SSL/TLS configuration handling. A remote attacker can bypass trust restrictions and gain unauthorized access to the application.
5) Improper Output Neutralization for Logs (CVE-ID: CVE-2026-34478)
CWE-ID: CWE-117 - Improper Output Neutralization for Logs
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to inject arbitrary log entries.
The vulnerability exists due to improper neutralization of CRLF sequences in Rfc5424Layout when processing logged data with direct Rfc5424Layout configuration using TCP framing. A remote attacker can supply specially crafted input containing CRLF sequences to inject arbitrary log entries.
Only users of stream-based syslog services who configure Rfc5424Layout directly are affected. Users of the SyslogAppender are not affected.
6) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2025-67721)
CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to insertion of sensitive information into sent data in the Java-based Snappy and LZ4 decompressor implementation when processing crafted compressed input. A remote attacker can send specially crafted compressed input to disclose sensitive information.
Exploitation requires the application to reuse the same decompression output buffer across calls without clearing it first.
7) Path traversal (CVE-ID: CVE-2025-67030)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to write arbitrary files.
The vulnerability exists due to path traversal in the extractFile function when extracting archive entries with traversal sequences or absolute paths. A remote attacker can supply a specially crafted archive to write arbitrary files.
If a written file is later used as an executable or configuration file, this may lead to code execution in the context of the current working user.
8) XML External Entity injection (CVE-ID: CVE-2026-24400)
CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to `org.assertj.core.util.xml.XmlStringPrettyFormatter`: the `toXmlDocument(String)` method initializes `DocumentBuilderFactory` with default settings, without disabling DTDs or external entities. A remote attacker can pass a specially crafted XML code to the affected application and view contents of arbitrary files on the system or initiate requests to external systems.
Successful exploitation of the vulnerability may allow an attacker to view contents of arbitrary file on the server or perform network scanning of internal and external infrastructure.
Remediation
Install update from vendor's website.