CVE-2026-91392 in Siebel CRM End User
Summary
by MITRE • 10/21/2026
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel CRM End User accessible data. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Open UI component of Oracle Siebel CRM, specifically affecting end-user versions ranging from 17.0 through 26.9. This security flaw represents a significant integrity risk for organizations relying on this customer relationship management platform to manage sensitive business data and interactions. The core issue stems from insufficient access control mechanisms or input validation failures within the Open UI layer, which serves as the primary interface between end-users and the underlying Siebel application logic. While the vulnerability is classified as difficult to exploit due to high complexity requirements for successful execution, its potential impact on data integrity remains a critical concern for system administrators and security teams responsible for maintaining the confidentiality and trustworthiness of enterprise information systems.
From a technical perspective, this flaw allows an unauthenticated attacker with network access via HTTP to compromise the Siebel CRM End User environment without requiring valid credentials or user interaction. The absence of proper authentication checks at specific endpoints or API calls within the Open UI architecture enables malicious actors to manipulate server-side operations directly through crafted HTTP requests. This bypasses standard security controls that would typically require a logged-in session, thereby exposing internal data structures and business logic to external manipulation. The vulnerability aligns with CWE-269, which describes Improper Privilege Management, as it permits actions beyond the scope of an anonymous user role. Furthermore, the ability to perform unauthorized updates, inserts, or deletes maps directly to CWE-778, Insufficient Initial Input Validation, and CWE-352, Cross-Site Request Forgery if the attack vector involves tricking a legitimate client into making requests, although in this specific unauthenticated context, it primarily reflects a failure in enforcing access controls on state-changing operations.
The operational impact of exploiting this vulnerability centers on unauthorized modifications to accessible data within Siebel CRM. Successful exploitation can lead to integrity violations where an attacker alters existing records, inserts fraudulent entries, or deletes critical information without authorization. This compromises the reliability and accuracy of business processes that depend on the system for decision-making, customer management, and operational tracking. Although the CVSS 3.1 base score is rated at 3.7 with a Low impact rating, this metric primarily reflects the limited scope to integrity rather than confidentiality or availability. However, in real-world scenarios, even low-severity integrity issues can be chained with other vulnerabilities or leveraged for social engineering attacks that escalate privileges later. The attack vector being network-accessible and requiring no user interface interaction makes it particularly dangerous if exposed directly to untrusted networks such as the public internet without adequate perimeter defenses.
In terms of threat modeling, this vulnerability corresponds to ATT&CK technique T1078, Valid Accounts, in a broad sense by bypassing authentication requirements, or more accurately T1195, Supply Chain Compromise, if exploited via third-party integrations, but most closely aligns with T1496, Resource Hijacking or data manipulation techniques under the Impact tactic. The high complexity of exploitation suggests that automated scanning tools may not easily detect this flaw without sophisticated fuzzing or manual analysis of HTTP request parameters and response behaviors. Attackers must carefully craft payloads to trigger the specific code paths responsible for the integrity failure, requiring a deep understanding of the Siebel Open UI architecture and its API endpoints.
Mitigation strategies should prioritize immediate patching by applying the latest security updates provided by Oracle for the affected versions 17.0 through 26.9. Organizations must verify their current version against the supported list to ensure they are not running vulnerable software that has reached end-of-life or lacks critical patches. In addition to updating, implementing strict network segmentation is essential; Siebel CRM instances should never be directly exposed to untrusted networks via HTTP without a reverse proxy enforcing HTTPS and additional authentication layers such as Web Application Firewalls (WAF). The WAF can help detect and block anomalous request patterns associated with this vulnerability by monitoring for unusual data modification attempts from anonymous sources. Regular security assessments, including penetration testing focused on access control flaws, should be conducted to identify similar weaknesses in other components of the Siebel ecosystem. Monitoring logs for unauthorized update or delete operations originating from unauthenticated sessions will also aid in early detection and incident response efforts.