Our takeOracle's October CPU fixes 95 criticals including CVE-2026-101446 (Siebel Cloud Manager, CVSS 9.9, low-priv network compromise). Patch Siebel CRM Cloud 17.0-26.9 now; the rest of the bundle can ride your normal cycle.Security Resilience desk
Most resource-constrained teams don't run on-prem Siebel and can ignore this one; enterprises still on it should treat the Siebel fix as out-of-band. No evidence of exploitation in the wild.
Sources (12)
- oracle_patch · oracle_patch
- nvd_recent · nvd_recent
- nvd_recent · nvd_recent
- nvd_recent · nvd_recent
- nvd_recent · nvd_recent
- nvd_recent · nvd_recent
- nvd_recent · nvd_recent
- auscert_bulletins · auscert_bulletins
- auscert_bulletins · auscert_bulletins
- auscert_bulletins · auscert_bulletins
- auscert_bulletins · auscert_bulletins
- auscert_bulletins · auscert_bulletins
What this means for you — Security leader:Apply the October 2026 Oracle CPU this cycle unless you run Siebel CRM Cloud 17.0–26.9 (CVE-2026-101446, CVSS 9.9, low-priv network compromise with scope change) or the four other listed criticals with scope change; those justify out-of-band patching.
What this means for you — Lean IT orgs:Most teams using Oracle Cloud services can wait for the normal patch window. If you self-host Siebel CRM versions 17.0–26.9, apply the October CPU as soon as possible.
What this means for you — MSP:Check client estates for self-hosted Siebel CRM 17.0–26.9 and the four other scoped criticals (E-Business Suite Workflow, Access Manager, SOA Suite x2); schedule out-of-band patching for any that match. Everything else rides the normal Oracle CPU cycle.
What this means for you — Researcher:Oracle's October 2026 CPU fixes 1739 CVEs including 95 criticals; CVE-2026-101446 (Siebel CRM Cloud Manager) stands out for low-priv HTTP compromise with significant scope change.