CVE-2026-91364 in Siebel CRM Cloud Applications
Summary
by MITRE • 10/21/2026
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM Cloud Applications accessible data as well as unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Siebel Cloud Manager component of Oracle Siebel CRM, affecting supported versions ranging from 22.3 through 26.9. This security flaw is classified as a difficult-to-exploit issue that requires an attacker to have physical access to the communication segment attached to the hardware hosting the application. The attack vector is categorized as Adjacent Network (AV:A), indicating that the vulnerability cannot be exploited remotely over the internet but rather through direct connection to the local network or physical infrastructure where the system operates. Despite the high complexity of exploitation, which corresponds to a High Attack Complexity (AC:H) in CVSS terms, the requirement for no prior authentication (PR:N) and no user interaction (UI:N) significantly lowers the barrier for an insider threat or a physically present attacker with limited network access.
The technical nature of this flaw allows an unauthenticated actor to compromise the integrity and confidentiality of the Siebel CRM Cloud Applications environment. Successful exploitation enables the creation, deletion, or modification of critical data within the system. This capability directly impacts the availability and consistency of business-critical information managed by the enterprise resource planning and customer relationship management workflows. Furthermore, the vulnerability grants unauthorized access to sensitive data that is otherwise protected by standard authentication mechanisms. The attacker can potentially view confidential records, financial details, or personal identifiable information stored in the database, leading to severe breaches of privacy and corporate secrets.
From an impact perspective, this vulnerability results in High impacts on both Confidentiality (C:H) and Integrity (I:H), while Availability remains unaffected according to the provided CVSS vector. The loss of confidentiality means that sensitive business data can be exfiltrated or viewed by unauthorized parties. The integrity compromise implies that malicious actors could alter transactional records, customer profiles, or system configurations without detection, potentially leading to financial fraud, regulatory non-compliance, and reputational damage. The overall severity is rated as Medium with a CVSS 3.1 Base Score of 6.8, reflecting the balance between the significant potential impact on data security and the restrictive conditions required for exploitation.
In terms of industry standard classifications, this vulnerability aligns with CWE-20 Improper Input Validation if the flaw stems from inadequate checking of network packets or commands received via the physical segment. It also relates to CWE-798 Use of Hard-coded Credentials if authentication bypass is achieved through static keys, though the description emphasizes unauthenticated access rather than credential misuse specifically. From a tactical perspective under the MITRE ATT&CK framework, this scenario maps to Initial Access techniques involving Local Network Discovery or potentially T1046 Network Service Scanning if the attacker uses the adjacent position to probe for open services. The subsequent actions of data modification and exfiltration correspond to Data Manipulation (T1565) and Exfiltration Over C2 Channel (T1071), assuming the compromised system is used as a pivot point or direct access method for further operations.
Mitigation strategies must focus on physical security controls since remote exploitation is not feasible due to the adjacent network requirement. Organizations should restrict physical access to server rooms, data centers, and network closets where Siebel CRM hardware resides. Implementing strict port security on switches connected to these segments can prevent unauthorized devices from attaching to the same broadcast domain as critical servers. Additionally, deploying Network Access Control (NAC) solutions ensures that only authenticated and authorized endpoints can communicate with the infrastructure hosting Siebel applications. While patching is always recommended for underlying software components, this specific vulnerability highlights the necessity of securing the physical layer of the OSI model. Regular audits of network topology and access logs should be conducted to detect any unauthorized device connections or anomalous traffic patterns originating from adjacent segments.