CVE-2026-91390 in Siebel CRM End User
Summary
by MITRE • 10/21/2026
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel CRM End User, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel CRM End User accessible data as well as unauthorized read access to a subset of Siebel CRM End User accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Open UI component of Oracle Siebel CRM, specifically affecting end-user versions ranging from 17.0 through 26.9. This security flaw represents a significant risk to organizations relying on this enterprise customer relationship management platform for critical business operations. The core issue stems from insufficient validation or sanitization mechanisms within the web-based interface layer, which processes user input via HTTP requests. Because Open UI serves as the primary interaction point between end-users and the backend database systems, any compromise in its integrity directly threatens the confidentiality and integrity of the stored corporate data.
From a technical perspective, this vulnerability is classified under CWE-79, commonly known as Cross-Site Scripting (XSS), or potentially CWE-835 regarding loop issues if it involves denial of service vectors, though the described impact points more strongly toward injection-based flaws allowing unauthorized data manipulation. The attack vector requires network access and low privileged authentication, meaning an attacker does not need administrative rights to initiate the exploit. However, a critical constraint is that successful exploitation demands human interaction from a victim other than the attacker. This typically manifests as a phishing scenario where a legitimate user must click on a malicious link or interact with a crafted payload embedded within the application interface. Despite this requirement for social engineering, the low complexity of the attack makes it highly feasible in targeted campaigns against employees who may not be security-aware.
The operational impact of exploiting this vulnerability is severe due to the scope change characteristic noted in the CVSS vector. While the initial compromise occurs within the Siebel CRM End User interface, the consequences extend beyond that specific component. Successful exploitation allows an attacker to perform unauthorized updates, inserts, or deletes on accessible data, as well as read a subset of sensitive information. This directly impacts the integrity and confidentiality aspects of the CIA triad. For instance, an attacker could alter customer contact details, delete critical sales records, or exfiltrate proprietary business intelligence stored within the CRM database. The CVSS 3.1 base score of 5.4 reflects these moderate but tangible risks, with a vector string indicating network accessibility, low attack complexity, and required user interaction.
In alignment with industry standards such as MITRE ATT&CK, this vulnerability facilitates techniques related to Initial Access through phishing or Drive-by Code Execution if the payload is delivered via compromised web content. It also enables Persistence or Collection phases by allowing the attacker to manipulate data silently over time without immediate detection. The scope change indicates that the vulnerability allows for privilege escalation in terms of data impact, effectively bridging the gap between a low-privileged user account and significant database manipulation capabilities. This underscores the importance of treating UI-layer vulnerabilities not as isolated interface issues but as potential gateways to backend system compromise.
Mitigation strategies must prioritize immediate patching by Oracle Siebel CRM administrators for all affected versions within the 17.0 to 26.9 range. Organizations should verify their current deployment version and apply the latest security updates provided by Oracle in a timely manner. In addition to patching, implementing strict input validation on both client-side and server-side components is essential to prevent injection-based attacks. Security teams should also enforce Content Security Policy headers to mitigate the impact of any residual XSS vulnerabilities that might allow script execution. Furthermore, user awareness training programs are critical given the requirement for human interaction in this attack vector; employees must be educated to recognize suspicious links or unusual behavior within the Siebel interface. Regular security audits and penetration testing focused on web application logic can help identify similar flaws before they are exploited by malicious actors.