CVE-2026-91377 in Siebel CRM Integration
Summary
by MITRE • 10/21/2026
Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration). Supported versions that are affected are 25.12-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM Integration accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Open Integration component of Oracle Siebel CRM, specifically affecting supported versions ranging from 25.12 through 26.9. This security flaw represents a critical weakness in the authentication and access control mechanisms governing how external systems interact with the core customer relationship management platform via HTTP protocols. The nature of this defect allows for an unauthenticated attacker to exploit the integration layer without requiring valid credentials or user interaction, thereby bypassing standard security boundaries that are typically enforced by the application logic. This lack of proper authorization checks creates a direct pathway for malicious actors to interact with sensitive backend services and data stores associated with the Siebel CRM environment.
From a technical perspective, the vulnerability is characterized as an access control failure where the system fails to properly verify the identity or privileges of incoming requests directed at specific integration endpoints. Because the attack vector relies on network accessibility via HTTP, it can be leveraged remotely by adversaries positioned anywhere within reach of the target network infrastructure. The simplicity of exploitation means that automated scanning tools and script-based attacks can easily identify and exploit this weakness against vulnerable instances. This aligns with common patterns found in web application vulnerabilities where API endpoints or integration interfaces are exposed without adequate authentication guards, leading to unauthorized data retrieval capabilities.
The operational impact of successfully exploiting this vulnerability is severe, primarily centered around the compromise of confidentiality within the organization's customer data ecosystem. An attacker gaining access through this flaw can retrieve critical business information stored within Siebel CRM, including but not limited to client contact details, transaction histories, sales pipelines, and potentially sensitive personal identifiable information depending on the specific configuration and data volume held by the enterprise. The complete access to all accessible integration data implies that once inside, there are no inherent restrictions preventing the exfiltration of large volumes of structured or unstructured data. This level of unauthorized access can lead to significant regulatory compliance violations under frameworks such as GDPR or CCPA, reputational damage, and potential financial losses due to intellectual property theft or fraud facilitated by the stolen customer intelligence.
In terms of industry classification standards, this vulnerability maps directly to CWE-287, which describes Improper Authentication, specifically where an actor is able to bypass authentication mechanisms entirely. Furthermore, it aligns with MITRE ATT&CK technique T1078, Valid Accounts, although in this case the attacker does not possess valid accounts initially but exploits a flaw that effectively grants them equivalent privileges through unauthenticated access paths. The CVSS 3.1 base score of 7.5 reflects the high severity associated with network-accessible, low-complexity attacks that result in significant confidentiality impacts without affecting integrity or availability directly. This scoring underscores the urgency required to address this issue before it can be weaponized by threat actors targeting enterprise CRM systems for data espionage purposes.
Mitigation strategies must focus on immediate remediation through vendor-provided patches and updates released by Oracle for the affected Siebel CRM versions. Organizations should apply the latest security bundles that specifically address authentication flaws in the Open Integration component to restore proper access control enforcement. In addition to patching, it is advisable to implement network-level controls such as web application firewalls or API gateways that can inspect incoming HTTP requests and block those lacking valid authentication tokens before they reach the vulnerable integration endpoints. Restricting direct internet exposure of these specific integration interfaces by placing them behind internal networks or secure proxies further reduces the attack surface. Continuous monitoring for anomalous access patterns to CRM data should also be enabled to detect any potential exploitation attempts in real-time, ensuring that even if a vulnerability is present, its impact can be minimized through rapid detection and response capabilities.