CVE-2026-91363 in Siebel CRM Cloud Applications
Summary
by MITRE • 10/21/2026
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Siebel Cloud Manager component of Oracle Siebel CRM, specifically affecting supported versions ranging from 22.3 through 26.9. This security flaw represents a significant risk to organizations relying on this enterprise customer relationship management platform for managing sensitive business data and client interactions. The core issue is characterized as an unauthenticated access vulnerability that can be exploited remotely over the network via HTTP protocols. While the attack complexity is classified as high, meaning it requires specific conditions or precise timing to succeed, the fact that no authentication credentials are required makes this a critical concern for system administrators who may have inadvertently exposed management interfaces to external networks without adequate perimeter defenses.
From a technical perspective, the flaw allows an attacker with network access to bypass standard security controls and gain unauthorized read-only access to a subset of data within Siebel CRM Cloud Applications. This capability aligns closely with CWE-284, which describes Improper Access Control, specifically where insufficient restrictions are placed on unauthenticated users. The vulnerability likely stems from misconfigured endpoint permissions or logic errors in the request handling mechanisms of the cloud manager interface that fail to properly validate user identity before serving sensitive information. Because the impact is limited to confidentiality and does not involve modification or destruction of data, it falls under CWE-200, which covers Exposure of Sensitive Information to an Unauthorized Actor. The attacker can potentially extract proprietary business intelligence, customer contact details, sales pipelines, or other confidential records stored within the compromised subset of the application.
The operational impact of this vulnerability is primarily centered on data privacy and regulatory compliance rather than system availability or integrity. Although the CVSS 3.1 base score is rated at 3.7 with a low confidentiality impact, the nature of CRM systems means that even partial exposure can lead to severe consequences including loss of competitive advantage, violation of GDPR or CCPA regulations due to personal data leakage, and erosion of customer trust. The attack vector corresponds to ATT&CK technique T1078, Valid Accounts, although in this case it is exploited without valid credentials by leveraging the lack of authentication requirements on specific endpoints. This suggests that attackers could use automated scanning tools to identify vulnerable instances and attempt to exploit the flaw during periods when security monitoring might be less active or when network segmentation policies are not strictly enforced between internal management networks and public-facing services.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary recommendation is to apply the latest security patches provided by Oracle for Siebel CRM versions 22.3 through 26.9 as soon as they become available, ensuring that all components including the Cloud Manager are updated to address these specific access control flaws. In addition to patching, organizations should implement strict network segmentation policies to ensure that management interfaces and administrative consoles are not directly accessible from untrusted networks such as the public internet. Access controls must be reinforced by requiring multi-factor authentication for any administrative or managerial functions within the Siebel environment. Furthermore, security teams should conduct regular vulnerability assessments and penetration tests focused on identifying exposed endpoints with weak access control configurations to prevent similar exploitation vectors in the future.