CVE-2026-91372 in Siebel CRM Cloud Applications
Summary
by MITRE • 10/21/2026
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 3.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Siebel Cloud Manager component of Oracle Siebel CRM, specifically affecting supported versions ranging from 22.3 through 26.9. This security flaw represents a significant risk to organizations relying on this enterprise customer relationship management platform for their operational data integrity and confidentiality. The core issue stems from an improper access control mechanism that fails to adequately restrict resource interactions based on user privileges, allowing individuals with lower-level credentials to perform actions beyond their intended scope within the application infrastructure.
From a technical perspective, the flaw enables low-privileged attackers who have successfully authenticated to the underlying infrastructure hosting Siebel CRM Cloud Applications to exploit this misconfiguration. The attacker does not require any complex social engineering or visual interaction, as indicated by the absence of user interface requirements in the vulnerability metrics. Instead, the exploitation relies on direct network access and valid authentication credentials at a low privilege level. Once inside the environment, the attacker can leverage the flawed logic within Siebel Cloud Manager to bypass standard authorization checks, thereby gaining unauthorized read access to specific subsets of data that should remain restricted to higher-privileged administrators or authorized personnel only.
The operational impact of this vulnerability is primarily centered on confidentiality breaches rather than integrity or availability disruptions. Successful exploitation results in the exposure of sensitive corporate information stored within Siebel CRM Cloud Applications. This could include customer personal identifiable information, sales pipelines, contract details, and other proprietary business data. The CVSS 3.1 base score of 3.3 reflects a low severity rating due to the limited scope of impact, which is confined strictly to confidentiality with no implications for system integrity or availability. However, even low-severity vulnerabilities can lead to significant regulatory compliance issues under frameworks such as GDPR or CCPA if personal data is exposed, and they often serve as stepping stones for more severe attacks in multi-stage intrusion scenarios.
In terms of industry standard classifications, this vulnerability aligns with CWE-269, which denotes Improper Privilege Management, specifically where an actor obtains privileges that are not properly restricted. Furthermore, the attack vector corresponds to MITRE ATT&CK techniques related to Initial Access and Credential Access, as it requires valid logon credentials but exploits a lack of proper privilege separation within the application layer rather than stealing passwords directly. The local network access requirement (AV:L) suggests that this vulnerability is most critical for environments where internal networks are not strictly segmented or where lateral movement controls are insufficiently enforced between different user groups and system components.
Mitigation strategies should focus on both immediate remediation and long-term architectural improvements. Oracle has likely released patches addressing the specific code flaws within Siebel Cloud Manager; therefore, applying the latest security updates for versions 22.3 through 26.9 is the primary corrective action. Organizations must ensure that their patch management processes are agile enough to deploy these fixes promptly across all affected instances. Additionally, implementing strict network segmentation can limit the attack surface by ensuring that only authorized administrative hosts have access to the infrastructure components running Siebel CRM Cloud Applications.
Beyond technical patches, organizations should review and enforce least-privilege principles for all user accounts interacting with the Siebel environment. This involves auditing existing roles and permissions to ensure that low-privileged users do not possess unnecessary access rights that could be exploited in conjunction with this vulnerability. Multi-factor authentication should also be enforced for all logons to reduce the risk of credential compromise, which is a prerequisite for exploiting this flaw. Regular security assessments and penetration testing focused on privilege escalation paths can help identify similar misconfigurations before they are exploited by malicious actors. Continuous monitoring of access logs for anomalous read activities from low-privileged accounts will also aid in early detection of potential exploitation attempts.