CVE-2026-91389 in Siebel CRM End User
Summary
by MITRE • 10/21/2026
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel CRM End User, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel CRM End User accessible data as well as unauthorized read access to a subset of Siebel CRM End User accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Open UI component of Oracle Siebel CRM, specifically affecting end-user versions ranging from 17.0 through 26.9. This security flaw represents a significant risk to organizations relying on this enterprise customer relationship management platform for critical business operations. The core issue stems from insufficient validation or sanitization mechanisms within the web-based interface layer, which processes user input via HTTP requests. Because Open UI serves as the primary interaction point between end-users and the underlying Siebel database, any weakness in its handling of client-side data can have cascading effects on backend integrity and confidentiality. The presence of this flaw indicates a failure to properly enforce separation between trusted administrative functions and untrusted user inputs within the web application architecture.
Exploitation of this vulnerability requires a low-privileged attacker who has network access to the Siebel CRM environment, typically via standard HTTP protocols. A defining characteristic of this exploit is its reliance on human interaction; it cannot be executed through automated scripts or passive scanning alone but necessitates that a victim user performs specific actions within the application interface. This social engineering aspect aligns with common attack vectors where an attacker might lure a legitimate user into clicking a malicious link, uploading a crafted file, or interacting with a specially constructed form element designed to trigger the flaw. The requirement for human interaction significantly raises the barrier to entry for automated mass exploitation but does not eliminate the threat, particularly in environments where users are prone to phishing or social engineering tactics.
The operational impact of this vulnerability is substantial due to its scope change characteristic. Although the technical flaw exists within the Siebel CRM End User component, successful exploitation can lead to unauthorized modifications and data access that extend beyond the immediate application context. Specifically, attackers gain the ability to perform unauthorized updates, inserts, or deletes against accessible data sets, as well as read a subset of sensitive information stored within the system. This dual impact on both confidentiality and integrity means that an attacker could exfiltrate proprietary customer data while simultaneously corrupting records by altering or deleting critical business entries. Such actions can disrupt operational workflows, lead to financial loss through fraudulent transactions or record tampering, and cause reputational damage due to compromised data privacy.
From a classification perspective, this vulnerability maps closely to CWE-79, which covers Cross-Site Scripting (XSS) vulnerabilities where untrusted input is not properly neutralized before being placed in web pages consumed by other users. It also relates to CWE-601, URL Redirection to Untrusted Site, if the exploitation involves redirecting victims to malicious domains for further compromise. In terms of offensive security frameworks, this aligns with MITRE ATT&CK techniques such as T1566.002 (Spearphishing Link) and potentially T1078 (Valid Accounts), given that it requires authenticated access but leverages low-privilege credentials to achieve higher impact through social engineering. The CVSS 3.1 base score of 5.4 reflects the moderate severity, balancing the network accessibility and low attack complexity against the requirement for user interaction and limited privilege level needed by the attacker.
Mitigation strategies must address both technical controls and organizational policies. Oracle should be consulted immediately to apply available patches or security updates that rectify the input validation logic within the Open UI component. In the absence of immediate patching, network-level mitigations such as Web Application Firewalls (WAF) can be configured to detect and block anomalous HTTP requests associated with this exploit pattern. Additionally, implementing strict Content Security Policy headers can help mitigate potential script injection vectors if XSS is involved. From a user perspective, security awareness training focused on recognizing social engineering attempts and verifying the source of links or uploads within the CRM interface is crucial. Regular audits of access controls ensure that low-privileged accounts do not have excessive permissions to sensitive data modules, thereby reducing the blast radius should an account be compromised through this vulnerability.