CVE-2026-91388 in Siebel CRM End User
Summary
by MITRE • 10/21/2026
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel CRM End User, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel CRM End User accessible data as well as unauthorized read access to a subset of Siebel CRM End User accessible data. CVSS 3.1 Base Score 4.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Open UI component of Oracle Siebel CRM, specifically affecting end-user versions ranging from 17.0 through 26.9. This security flaw represents a significant risk to organizations relying on this enterprise customer relationship management platform for critical business operations. The core issue is characterized as an unauthenticated attack vector that operates over the HTTP protocol, allowing external actors to interact with the application without prior credential validation. While the vulnerability technically impacts the Siebel CRM End User interface, its operational scope extends beyond isolated data manipulation due to potential lateral impact on associated backend systems and integrated products, thereby altering the traditional boundary of risk assessment for this specific component.
From a technical perspective, the flaw is classified as difficult to exploit, which correlates with a high attack complexity rating in standard vulnerability scoring models. This difficulty stems from the requirement that successful exploitation necessitates human interaction from a victim other than the attacker. In practical terms, this indicates that automated scanning tools are unlikely to trigger the condition successfully; instead, the vulnerability relies on social engineering tactics or phishing scenarios where an unsuspecting user must perform specific actions within their browser session while authenticated to the Siebel environment. This mechanism aligns with common patterns found in Cross-Site Request Forgery (CSRF) or complex client-side logic flaws where state-changing operations are not adequately protected against unauthorized initiation by third-party contexts.
The operational impact of a successful exploit is primarily focused on data integrity and confidentiality, as reflected in the CVSS 3.1 base score of 4.7. An attacker who successfully leverages this vulnerability can achieve unauthorized read access to a subset of accessible Siebel CRM data, leading to potential information disclosure. Furthermore, the attacker gains the ability to perform unauthorized updates, inserts, or deletes on certain datasets within the application. This dual impact compromises both the confidentiality and integrity aspects of the CIA triad, while availability remains unaffected according to the provided vector string. The scope change noted in the description suggests that actions taken against Siebel data could trigger cascading effects on linked enterprise systems, potentially amplifying the business risk beyond simple data corruption within the CRM itself.
In terms of industry standard classifications, this vulnerability exhibits characteristics consistent with CWE-352 Cross-Site Request Forgery or CWE-798 Use of Hard-coded Credentials if authentication bypass is involved in a non-standard manner, though the primary driver appears to be insufficient validation of user-initiated actions against maliciously crafted requests. The requirement for human interaction places it firmly within the ATT&CK technique T1566 Phishing, where attackers manipulate users into executing unintended commands or accessing sensitive resources. The network access vector and lack of required privileges highlight a failure in proper input validation and state management at the application layer rather than infrastructure-level weaknesses.
Mitigation strategies must prioritize immediate patching to the latest supported version of Oracle Siebel CRM that addresses this specific Open UI flaw, as vendor-provided patches are typically designed to correct underlying logic errors or add necessary security headers such as anti-CSRF tokens. In environments where patching is not immediately feasible, network-level controls should be implemented to restrict HTTP access to the Siebel interface exclusively from trusted internal subnets, thereby reducing the attack surface for external actors. Additionally, implementing strict Content Security Policy (CSP) directives can help mitigate client-side exploitation by preventing unauthorized scripts or form submissions. User awareness training is also critical given the social engineering aspect of this vulnerability; employees should be educated to recognize suspicious links and avoid interacting with unexpected prompts within enterprise applications that request unusual data modifications or access patterns.