CVE-2026-91387 in Siebel CRM End User
Summary
by MITRE • 10/21/2026
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel CRM End User accessible data as well as unauthorized read access to a subset of Siebel CRM End User accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Open UI component of Oracle Siebel CRM, specifically affecting end-user versions ranging from 17.0 through 26.9. This security flaw is characterized by its susceptibility to exploitation via standard HTTP network connections, allowing an attacker with low privileges and valid network access to interact directly with the application interface. The core technical issue involves a failure in proper authorization checks or input validation within the Open UI layer, which serves as the primary interaction point for end-users. This architectural weakness enables malicious actors to manipulate data operations that should be restricted based on user roles or permissions, effectively bypassing intended security controls through standard web requests without requiring any user interface interaction such as clicking a link or executing a script.
The operational impact of this vulnerability is significant regarding both the confidentiality and integrity of enterprise data managed by Siebel CRM. Successful exploitation allows an attacker to perform unauthorized updates, inserts, or deletions against accessible data sets, thereby compromising the integrity of critical business information. Furthermore, the flaw grants unauthorized read access to a subset of data that should remain restricted from low-privileged users. This dual impact on confidentiality and integrity means that sensitive customer records, financial details, or operational metrics could be exfiltrated or altered without detection by standard monitoring tools if proper logging is not configured. The CVSS 3.1 base score of 5.4 reflects a medium severity level, driven primarily by the low attack complexity and the absence of user interaction requirements, which facilitates automated exploitation at scale across an organization's network perimeter.
From a classification perspective, this vulnerability aligns with CWE-862 Missing Authorization, as it permits actions that should be restricted based on user identity or role. It also maps to MITRE ATT&CK techniques related to Data Manipulation and potentially Credential Access if the initial low privilege is obtained through phishing or other means. The attack vector being network-accessible via HTTP indicates that this flaw can be exploited remotely, making it a high-priority target for automated scanning tools and opportunistic attackers seeking to compromise enterprise resource planning systems. The lack of user interface interaction requirement further elevates the risk profile, as it removes common defense-in-depth barriers like social engineering or physical proximity requirements often associated with higher-severity vulnerabilities.
Mitigation strategies must focus on immediate patching and access control hardening. Oracle has released updates for supported versions within the 17.0 to 26.9 range that address this specific flaw in the Open UI component; organizations should prioritize applying these security patches as soon as possible. In addition to patching, implementing strict network segmentation is recommended to limit HTTP access to Siebel CRM servers from untrusted networks or low-privilege user segments. Web Application Firewalls can be configured with rulesets specifically designed to detect and block anomalous data manipulation patterns associated with this vulnerability type. Regular audits of user permissions within the Siebel application should also be conducted to ensure that least privilege principles are strictly enforced, minimizing the potential blast radius if a low-privileged account is compromised. Continuous monitoring for unusual database write operations or unexpected read access patterns can provide early detection indicators for exploitation attempts in environments where immediate patching may be delayed due to operational constraints.