CVE-2026-91367 in Siebel CRM Cloud Applications
Summary
by MITRE • 10/21/2026
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications. While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Siebel Cloud Manager component of Oracle Siebel CRM, specifically affecting supported versions ranging from 22.3 through 26.9. This security flaw represents a significant risk to organizations relying on this enterprise customer relationship management platform for critical business operations. The core issue stems from an improper access control mechanism that allows low-privileged attackers who have already established logon credentials to the underlying infrastructure where Siebel CRM Cloud Applications executes to exploit the weakness. Unlike many vulnerabilities that require high-level administrative privileges or complex interaction with user interfaces, this flaw can be triggered by an attacker with minimal initial access rights and no need for any user interface interaction, making it particularly dangerous in environments where internal network segmentation is weak or compromised credentials are obtained through phishing or other low-effort intrusion techniques.
From a technical perspective, the vulnerability enables unauthorized escalation of privileges within the application layer despite the attacker holding only basic infrastructure-level permissions. This misalignment between expected privilege levels and actual access capabilities creates an opportunity for scope change, meaning that while the initial point of entry is limited to the Siebel CRM Cloud Applications environment, successful exploitation can lead to a compromise of additional products or systems connected to or accessible from that same infrastructure. The operational impact is severe, as confirmed by the CVSS 3.1 base score of 6.5, which indicates medium severity with high confidentiality impacts. Successful attacks result in unauthorized access to critical data and potentially complete access to all Siebel CRM Cloud Applications accessible data. This level of exposure can lead to significant business disruption, regulatory non-compliance due to data breaches, and loss of customer trust if sensitive client information is exfiltrated or altered without authorization.
In terms of industry standard classifications, this vulnerability aligns with CWE-269 Improper Privilege Management, as it involves a failure in the system's ability to correctly enforce privilege boundaries between different user roles and infrastructure components. Furthermore, from an offensive security standpoint such as MITRE ATT&CK, this scenario maps closely to techniques involving Initial Access via valid accounts followed by Lateral Movement or Defense Evasion if the attacker uses the compromised credentials to move beyond the initial target system. The lack of required user interaction (UI:N) and low attack complexity (AC:L) further exacerbate the risk profile, allowing for automated exploitation tools to be developed and deployed with relative ease against unpatched systems.
To mitigate this vulnerability, organizations must prioritize applying the latest security patches provided by Oracle for Siebel CRM Cloud Manager immediately. It is critical to verify that all instances running versions 22.3 through 26.9 are updated to a version where this flaw has been remediated. In addition to patching, implementing strict network segmentation strategies can help contain potential breaches. By isolating the infrastructure hosting Siebel CRM from other sensitive systems, organizations can limit the scope of impact even if an attacker manages to exploit this vulnerability. Furthermore, enforcing multi-factor authentication and monitoring for anomalous login patterns or unusual data access behaviors can provide early detection indicators. Regular audits of user privileges should also be conducted to ensure that no accounts possess more infrastructure-level access than strictly necessary for their job functions, thereby reducing the attack surface available to low-privileged adversaries seeking to escalate their influence within the environment.