SB20261110226 - Multiple vulnerabilities in Siebel CRM Deployment

Description

This security bulletin contains information about 39 vulnerabilities.

1) Improper input validation (CVE-ID: CVE-2026-91448)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

2) Improper input validation (CVE-ID: CVE-2026-91434)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A local privileged user can exploit this vulnerability to execute arbitrary code.

3) Improper input validation (CVE-ID: CVE-2026-101453)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A local privileged user can exploit this vulnerability to execute arbitrary code.

4) Improper input validation (CVE-ID: CVE-2026-101464)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A local authenticated user can exploit this vulnerability to read and manipulate data.

5) Improper input validation (CVE-ID: CVE-2026-91438)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A remote authenticated user can exploit this vulnerability to read and manipulate data.

6) Improper input validation (CVE-ID: CVE-2026-40542)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Server Infrastructure (Apache HttpClient) component in Siebel CRM Deployment. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

7) Improper input validation (CVE-ID: CVE-2026-91450)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

8) Improper input validation (CVE-ID: CVE-2026-91449)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

9) Improper input validation (CVE-ID: CVE-2026-101460)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

10) Improper Certificate Validation (CVE-ID: CVE-2026-50010)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper certificate validation in X509TrustManagerWrapper within netty-handler when establishing client TLS connections with a user-supplied plain X509TrustManager. A remote attacker can present a certificate for an unexpected hostname to disclose sensitive information.

The issue occurs because hostname verification is not performed in this configuration, even when HTTPS endpoint identification is expected by default.

11) Improper input validation (CVE-ID: CVE-2026-91444)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A local privileged user can exploit this vulnerability to execute arbitrary code.

12) Improper input validation (CVE-ID: CVE-2026-91447)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

13) Improper input validation (CVE-ID: CVE-2026-101461)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

14) Improper input validation (CVE-ID: CVE-2026-101468)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Cloud Gateway component in Siebel CRM Deployment. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

15) Incomplete List of Disallowed Inputs (CVE-ID: CVE-2026-54513)

CWE-ID: CWE-184 - Incomplete List of Disallowed Inputs

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to instantiate non-allowlisted types.

The vulnerability exists due to incomplete list of disallowed inputs in BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() when deserializing attacker-controlled JSON containing array subtypes. A remote attacker can supply a crafted array wrapper to instantiate non-allowlisted types.

The issue occurs because array types are allowlisted based only on whether the class is an array, without validating the array component type against the configured allowlist, and no further validator check occurs for elements when per-element type IDs are absent.

16) Improper input validation (CVE-ID: CVE-2026-101458)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

17) Improper input validation (CVE-ID: CVE-2026-101459)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to compromise the affected system.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A remote authenticated user can exploit this vulnerability to compromise the affected system.

18) Improper input validation (CVE-ID: CVE-2026-91437)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to read and manipulate data.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A remote privileged user can exploit this vulnerability to read and manipulate data.

19) Improper input validation (CVE-ID: CVE-2026-91442)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A remote authenticated user can exploit this vulnerability to execute arbitrary code.

20) Incorrect Behavior Order: Validate Before Canonicalize (CVE-ID: CVE-2026-59083)

CWE-ID: CWE-180 - Incorrect Behavior Order: Validate Before Canonicalize

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass security controls.

The vulnerability exists due to incorrect URL decoding in RewriteValve when processing rewritten URIs. A remote attacker can send a specially crafted request to bypass security controls.

Only some configurations are vulnerable.

21) Improper input validation (CVE-ID: CVE-2026-91423)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to read and manipulate data.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A local privileged user can exploit this vulnerability to read and manipulate data.

22) Improper input validation (CVE-ID: CVE-2026-101449)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Siebel Management Console component in Siebel CRM Deployment. A local non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

23) Improper input validation (CVE-ID: CVE-2026-91436)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to read and manipulate data.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A local privileged user can exploit this vulnerability to read and manipulate data.

24) Improper input validation (CVE-ID: CVE-2026-101448)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Siebel Management Console component in Siebel CRM Deployment. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

25) Improper input validation (CVE-ID: CVE-2026-91422)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to manipulate data.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A remote authenticated user can exploit this vulnerability to manipulate data.

26) Improper input validation (CVE-ID: CVE-2026-91414)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

27) Improper input validation (CVE-ID: CVE-2026-101462)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A local authenticated user can exploit this vulnerability to gain access to sensitive information.

28) Improper input validation (CVE-ID: CVE-2026-91439)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A local authenticated user can exploit this vulnerability to gain access to sensitive information.

29) Improper input validation (CVE-ID: CVE-2026-91426)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A local authenticated user can exploit this vulnerability to gain access to sensitive information.

30) Improper input validation (CVE-ID: CVE-2026-91421)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A remote non-authenticated attacker can exploit this vulnerability to perform a denial of service (DoS) attack.

31) Improper input validation (CVE-ID: CVE-2026-91427)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to perform service disruption.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A local privileged user can exploit this vulnerability to perform service disruption.

32) Improper input validation (CVE-ID: CVE-2026-101465)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A local authenticated user can exploit this vulnerability to read and manipulate data.

33) Improper input validation (CVE-ID: CVE-2026-91424)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A remote authenticated user can exploit this vulnerability to read and manipulate data.

34) Improper input validation (CVE-ID: CVE-2026-91443)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A remote authenticated user can exploit this vulnerability to gain access to sensitive information.

35) Improper input validation (CVE-ID: CVE-2026-91440)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

36) Improper input validation (CVE-ID: CVE-2026-91435)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A remote authenticated user can exploit this vulnerability to perform a denial of service (DoS) attack.

37) Improper input validation (CVE-ID: CVE-2026-91429)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

38) Improper input validation (CVE-ID: CVE-2026-91420)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to manipulate data.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A remote authenticated user can exploit this vulnerability to manipulate data.

39) Improper input validation (CVE-ID: CVE-2026-91446)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A local privileged user can exploit this vulnerability to execute arbitrary code.

Remediation

Install update from vendor's website.

References

• https://www.oracle.com/security-alerts/cpuoct2026.html