CVE-2026-87339 Oracle Corporation CVE debrief

Who should care

Defenders responsible for Siebel CRM Integration systems, particularly those with HTTP access exposed, should assess their exposure and prioritize remediation based on data sensitivity.

Why it matters

CVE-2026-87339 is a low-severity vulnerability in Oracle Siebel CRM Integration that allows an unauthenticated attacker with network access via HTTP to potentially read a subset of accessible data. Defenders should prioritize verifying exposure, assessing remediation needs, and monitoring for unauthorized access attempts.

• Potential unauthorized read access to a subset of Siebel CRM Integration data
• Need for verification of system exposure and data sensitivity
• Prioritization of remediation efforts based on system configuration

Technical summary

The vulnerability is in the REST component of Siebel CRM Integration, affecting versions 17.0-26.9. It has a CVSS 3.1 Base Score of 3.1, indicating low severity. The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration, potentially resulting in unauthorized read access to a subset of accessible data. The technical impact is limited to confidentiality, with no potential for integrity or availability impacts. Defenders should prioritize verifying exposure and assessing the need for remediation, focusing on Siebel CRM Integration systems accessible via HTTP.

Defensive priority

Defenders should prioritize verifying exposure and assessing the need for remediation, focusing on Siebel CRM Integration systems accessible via HTTP.

Recommended defensive actions

• Verify exposure of Siebel CRM Integration systems to HTTP access
• Assess the need for remediation based on system configuration and data sensitivity
• Monitor for potential unauthorized read access attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score and vector. Oracle's security alert documentation is also available for reference. The vulnerability affects Siebel CRM Integration versions 17.0-26.9 and has a CVSS 3.1 Base Score of 3.1, indicating low severity. Defenders should verify exposure, assess remediation needs, and monitor for unauthorized access attempts. The evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.