CVE-2026-91360 in Siebel CRM Cloud Applications
Summary
by MITRE • 10/21/2026
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Siebel Cloud Manager component of Oracle Siebel CRM, specifically affecting supported versions ranging from 22.3 through 26.9. This security flaw represents a significant risk to organizations relying on this enterprise customer relationship management platform for critical business operations and data storage. The core issue stems from an improper access control mechanism within the HTTP interface exposed by the cloud manager service. While Siebel CRM is designed with robust role-based access controls, this specific component fails to adequately validate permissions before processing requests that target sensitive administrative functions or internal configuration endpoints. This misconfiguration allows for a bypass of standard authentication and authorization checks under certain conditions, creating an entry point that does not require high-level privileges or user interaction to exploit.
From a technical perspective, the vulnerability is classified as an insecure direct object reference combined with broken access control flaws. An attacker possessing low-privileged credentials can leverage network connectivity via HTTP to send crafted requests to the vulnerable endpoints. Because the validation logic for these specific administrative actions is flawed, the system processes commands intended only for high-level administrators or service accounts without verifying that the requesting user has the requisite authority. This architectural weakness effectively elevates the capabilities of a low-privileged account, allowing it to perform actions far beyond its designated scope. The absence of proper session validation and privilege checks in this specific component creates a predictable attack vector that can be automated by threat actors scanning for known weaknesses in Oracle Siebel deployments.
The operational impact of successfully exploiting this vulnerability is severe, primarily centered around the compromise of data confidentiality. As indicated by the CVSS 3.1 base score of 6.5 and its high confidentiality impact rating, an attacker who gains access through this flaw can retrieve unauthorized information from critical databases managed by Siebel CRM. This includes sensitive customer personal identifiable information, financial records, sales pipelines, and internal corporate communications stored within the application. In worst-case scenarios where data isolation between tenants or modules is weak due to additional misconfigurations, the scope of exposure could expand to include complete access to all accessible data within the environment. Although integrity and availability impacts are currently rated as none in this specific vector, the exfiltration of such high-value corporate intelligence can lead to significant regulatory penalties under frameworks like GDPR or CCPA, reputational damage, and competitive disadvantage.
This vulnerability aligns with Common Weakness Enumeration (CWE) identifiers such as CWE-269 Improper Privilege Management and CWE-862 Missing Authorization. Furthermore, in the context of the MITRE ATT&CK framework, this behavior corresponds to techniques involving Account Manipulation or Credential Access if the attacker uses gained access to further pivot within the network. The attack vector is categorized under Network (AV:N) with Low Complexity (AC:L), indicating that no special conditions are required for exploitation beyond basic network reachability and valid low-level credentials. It also falls under User Interaction None (UI:N), meaning automated tools can exploit this flaw without requiring any action from a legitimate user, such as clicking a link or opening a file.
To mitigate the risks associated with this vulnerability, organizations must prioritize immediate patching of all affected Siebel CRM Cloud Applications instances to versions released after the disclosure of this issue. Oracle has likely issued security patches that address the access control logic within the Siebel Cloud Manager component. Administrators should verify their current version against the supported range and apply updates according to standard change management procedures. In addition to patching, it is advisable to review network segmentation strategies to ensure that the HTTP interfaces of critical enterprise applications are not directly exposed to untrusted networks without robust web application firewalls or reverse proxies capable of inspecting for anomalous request patterns. Regular audits of user permissions and role assignments can also help minimize the blast radius if a low-privileged account is compromised, ensuring that even successful exploitation does not lead to total system compromise. Continuous monitoring of access logs for unusual administrative activity from standard user accounts should be implemented as an additional layer of defense against potential abuse of this flaw.