CVE-2026-91414 in Siebel CRM Deployment
Summary
by MITRE • 10/21/2026
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Server Infrastructure component of Oracle Siebel CRM Deployment, specifically affecting supported versions ranging from 17.0 through 26.9. This flaw represents a significant security risk as it allows an unauthenticated attacker to compromise the integrity and confidentiality of the deployment environment. The attack vector is network-based via HTTP, meaning that any entity with connectivity to the affected system can attempt exploitation without needing prior authentication credentials. However, the complexity of this vulnerability is classified as difficult, indicating that successful exploitation requires specific conditions or precise timing rather than a trivial automated script execution. This difficulty level suggests that while the underlying code flaw may be present, leveraging it effectively demands a high degree of technical skill and understanding of the application's internal state management mechanisms.
A critical characteristic of this vulnerability is its reliance on human interaction for successful exploitation. The requirement for user intervention implies that the attack likely involves social engineering tactics or relies on triggering specific UI-based actions that lead to unintended code execution or data exposure. This aligns with common patterns where a victim must perform an action, such as clicking a malicious link or uploading a crafted file through the web interface, which then triggers the underlying flaw in the server infrastructure. Consequently, while the technical pathway exists over the network, the practical barrier of requiring human participation serves as both a mitigation factor and a specific attack surface that security teams must monitor closely for suspicious user activities originating from external sources.
The operational impact of this vulnerability is severe regarding data confidentiality but limited in terms of system integrity and availability. Successful exploitation results in unauthorized access to critical data, potentially exposing sensitive customer information, business logic configurations, or proprietary corporate records stored within the Siebel CRM Deployment environment. The CVSS 3.1 base score of 5.3 reflects this medium severity, driven primarily by high confidentiality impact while maintaining no direct effect on integrity or availability according to the provided vector string (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N). This means that an attacker can read sensitive data but cannot easily modify system files or disrupt service operations through this specific flaw alone, although such access often serves as a stepping stone for further lateral movement within the network.
From a classification perspective, this vulnerability maps to CWE-20 Improper Input Validation if the issue stems from inadequate sanitization of HTTP requests leading to unauthorized data retrieval, or potentially CWE-798 if it involves hardcoded credentials or excessive privileges in the deployment infrastructure components. In terms of adversary behavior, this aligns with MITRE ATT&CK techniques related to Initial Access via Phishing (T1566) due to the human interaction requirement, and Credential Access or Data Exfiltration depending on how the unauthorized access is utilized post-exploitation. Security architects should treat this as a critical risk requiring immediate attention given the sensitivity of CRM data which often contains personally identifiable information subject to regulatory compliance frameworks such as GDPR or CCPA.
Mitigation strategies must focus on both technical controls and user awareness training. Since direct patching may not be immediately available for all affected versions, organizations should implement strict network segmentation to limit HTTP access from untrusted networks to the Siebel CRM Deployment servers. Web Application Firewalls (WAF) can be configured with rulesets designed to detect anomalous HTTP request patterns that might indicate exploitation attempts of this specific vulnerability type. Additionally, enforcing multi-factor authentication for all administrative and user accounts adds a layer of defense even if initial access is gained through human interaction flaws. Regular security awareness training should emphasize the risks of interacting with untrusted links or content within the CRM interface to reduce the likelihood of successful social engineering components associated with this flaw.