CVE-2026-91370 in Siebel CRM Cloud Applications
Summary
by MITRE • 10/21/2026
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Siebel Cloud Manager component of Oracle Siebel CRM, specifically affecting supported versions ranging from 22.3 through 26.9. This security flaw represents a significant risk to organizations relying on this enterprise customer relationship management platform for their operational data integrity and confidentiality. The core issue stems from an improper access control mechanism within the HTTP interface exposed by the cloud manager service. Because the vulnerability is easily exploitable, it does not require complex attack vectors or specific user interactions, allowing any external actor with network connectivity to initiate a successful exploitation attempt against the targeted system components.
From a technical perspective, the flaw allows for unauthenticated access to sensitive application data. The attacker leverages standard HTTP requests to interact with vulnerable endpoints that fail to properly validate authentication tokens or session states before processing queries. This lack of rigorous authorization checks means that an adversary can bypass security boundaries designed to restrict data visibility. Consequently, the vulnerability facilitates unauthorized read access to a specific subset of Siebel CRM Cloud Applications accessible data. While the scope is limited to reading rather than modifying or deleting information, the exposure of proprietary customer records, sales pipelines, and internal operational metrics constitutes a severe breach of confidentiality principles central to enterprise security postures.
The operational impact of this vulnerability extends beyond immediate data leakage. The disclosure of confidential business intelligence can lead to competitive disadvantage, regulatory non-compliance with standards such as GDPR or CCPA if personal identifiable information is exposed, and potential erosion of client trust. Although the CVSS 3.1 base score is rated at 5.3 indicating a medium severity level primarily due to its impact on confidentiality without affecting integrity or availability, the cumulative risk in an enterprise environment remains high. Attackers can use this initial access as a foothold for further reconnaissance, mapping out the internal network structure and identifying additional targets within the broader Oracle ecosystem. The attack vector is classified as Network with Low Complexity and requires no User Interaction, making it particularly dangerous against internet-facing deployments or poorly segmented internal networks where lateral movement is possible.
In alignment with industry standards, this vulnerability maps to CWE-284 Improper Access Control, which describes situations where an actor gains access to resources they are not authorized to view. Furthermore, the exploitation technique aligns with MITRE ATT&CK techniques related to Initial Access and Discovery, specifically those involving web application attacks that exploit misconfigured authentication or authorization logic. The specific vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N confirms that while the attack is straightforward and remote, it does not currently allow for privilege escalation or service disruption, focusing strictly on data exfiltration capabilities.
To mitigate this risk, organizations must immediately apply the latest security patches provided by Oracle for Siebel CRM Cloud Applications within the affected version range. It is critical to verify that all instances of Siebel Cloud Manager are updated to a version where the access control logic has been corrected. In addition to patching, administrators should review network segmentation strategies to ensure that management interfaces and cloud manager components are not directly exposed to untrusted networks without robust web application firewalls or strict IP whitelisting policies. Regular vulnerability scanning and penetration testing focused on authentication bypasses can help identify similar misconfigurations across the enterprise infrastructure before they can be exploited by malicious actors. Continuous monitoring of access logs for anomalous HTTP requests targeting these endpoints will also aid in early detection of exploitation attempts.