CVE-2026-91420 in Siebel CRM Deployment
Summary
by MITRE • 10/21/2026
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Server Infrastructure component of Oracle Siebel CRM, specifically affecting deployment configurations across supported versions ranging from 17.0 to 26.9. This security flaw represents a significant risk to organizations relying on this enterprise customer relationship management platform for critical business operations. The nature of the defect allows an attacker with low privileges and network access via HTTP to compromise the integrity of the Siebel CRM Deployment environment. Unlike vulnerabilities that require high-level administrative credentials or complex user interaction, this issue can be exploited by individuals who have already gained a foothold within the internal network or through compromised lower-privileged accounts, making it particularly dangerous in environments where lateral movement is possible.
From a technical perspective, the vulnerability stems from insufficient validation of input data processed during deployment operations. When an authenticated but low-privilege user submits specific requests over HTTP, the system fails to properly enforce access controls or sanitize inputs before processing them against critical configuration files and database structures. This lack of rigorous checks enables the attacker to manipulate internal states in ways that bypass standard permission boundaries. The exploitation does not require any visual interface interaction from a victim, as indicated by the absence of user interface requirements in the attack vector, allowing for automated scripting and rapid propagation within vulnerable networks.
The operational impact of this vulnerability is severe due to its direct effect on data integrity. Successful exploitation grants unauthorized actors the ability to create, delete, or modify critical data stored within the Siebel CRM Deployment system. This includes sensitive customer information, sales pipelines, service records, and other proprietary business intelligence that drives organizational decision-making. The compromise of such data can lead to significant financial loss, regulatory non-compliance with standards like GDPR or HIPAA if personal data is involved, and reputational damage. Furthermore, the ability to modify critical configurations could disrupt ongoing operations, leading to downtime and service unavailability for end-users who depend on the CRM platform for daily activities.
In terms of industry-standard classification frameworks, this vulnerability aligns closely with CWE-269 Improper Privilege Management, as it allows a lower-privileged user to perform actions reserved for higher-level administrators or system processes. It also relates to CWE-77 Injection and CWE-807 Reliance on Untrusted Inputs in Security Decisions, reflecting the failure to validate external inputs before executing privileged operations. Within the MITRE ATT&CK framework, this behavior is consistent with techniques involving Data Manipulation under the Impact tactic, specifically targeting data integrity rather than confidentiality or availability. The network-based nature of the attack places it within the Initial Access and Persistence phases if used as a stepping stone for deeper infiltration.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. Oracle has released patches addressing this specific flaw in subsequent updates, which should be applied immediately to all affected systems. Organizations running versions 17.0 through 26.9 are strongly advised to upgrade to the latest supported release that includes these security fixes. In addition to patching, implementing strict network segmentation can limit exposure by restricting HTTP access to the Siebel CRM deployment components from untrusted or low-privilege networks. Deploying Web Application Firewalls with rules tailored to detect injection patterns and unauthorized privilege escalation attempts can provide an additional layer of defense. Regular audits of user permissions are also essential to ensure that no unnecessary elevated privileges are granted, thereby reducing the attack surface available to potential intruders who might exploit this vulnerability after gaining initial access through other means.