CVE-2026-47032

Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Redwood UI). Supported versions that are affected are 24.4-26.3. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel CRM End User, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Siebel CRM End User. CVSS 3.1 Base Score 2.6 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:N/A:L).

CVSS v3 2.6 LOW

2.6^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.0 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://www.oracle.com/security-alerts/cpujul2026.html	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:oracle:siebel_crm:*:*:*:*:*:*:*:*

History

24 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad en el producto Siebel CRM End User de Oracle Siebel CRM (componente: Redwood UI). Las versiones compatibles afectadas son 24.4-26.3. Vulnerabilidad difícil de explotar que permite a un atacante con altos privilegios con acceso a la red a través de HTTP comprometer Siebel CRM End User. Los ataques exitosos requieren interacción humana de una persona que no sea el atacante y, aunque la vulnerabilidad está en Siebel CRM End User, los ataques pueden impactar significativamente productos adicionales (cambio de alcance). Los ataques exitosos de esta vulnerabilidad pueden resultar en la capacidad no autorizada de causar una denegación de servicio parcial (DoS parcial) de Siebel CRM End User. Puntuación base CVSS 3.1 de 2.6 (Impactos en la disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:N/A:L).

Information

Published : 2026-07-21 22:17

Updated : 2026-10-24 19:10

NVD link : CVE-2026-47032

Mitre link : CVE-2026-47032

CVE.ORG link : CVE-2026-47032

JSON object : View

Products Affected

oracle

siebel_crm

CWE

CWE-284

Improper Access Control

{"id": "CVE-2026-47032", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47032", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-23T16:13:27.034594Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert_us@oracle.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 2.6, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.0}]}, "affected": [{"source": "secalert_us@oracle.com", "affectedData": [{"vendor": "Oracle Corporation", "product": "Siebel CRM End User", "versions": [{"status": "affected", "version": "24.4", "versionType": "custom", "lessThanOrEqual": "26.3"}]}]}], "published": "2026-07-21T22:17:08.710", "references": [{"url": "https://www.oracle.com/security-alerts/cpujul2026.html", "tags": ["Vendor Advisory"], "source": "secalert_us@oracle.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Redwood UI). Supported versions that are affected are 24.4-26.3. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel CRM End User, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Siebel CRM End User. CVSS 3.1 Base Score 2.6 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:N/A:L)."}, {"lang": "es", "value": "Vulnerabilidad en el producto Siebel CRM End User de Oracle Siebel CRM (componente: Redwood UI). Las versiones compatibles afectadas son 24.4-26.3. Vulnerabilidad dif\u00edcil de explotar que permite a un atacante con altos privilegios con acceso a la red a trav\u00e9s de HTTP comprometer Siebel CRM End User. Los ataques exitosos requieren interacci\u00f3n humana de una persona que no sea el atacante y, aunque la vulnerabilidad est\u00e1 en Siebel CRM End User, los ataques pueden impactar significativamente productos adicionales (cambio de alcance). Los ataques exitosos de esta vulnerabilidad pueden resultar en la capacidad no autorizada de causar una denegaci\u00f3n de servicio parcial (DoS parcial) de Siebel CRM End User. Puntuaci\u00f3n base CVSS 3.1 de 2.6 (Impactos en la disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:N/A:L)."}], "lastModified": "2026-10-24T19:10:00.127", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:siebel_crm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C3F10432-C912-4761-AF7A-52025440C1CE", "versionEndIncluding": "26.3", "versionStartIncluding": "24.4"}], "operator": "OR"}]}], "sourceIdentifier": "secalert_us@oracle.com"}