CVE-2026-91423 in Siebel CRM Deployment
Summary
by MITRE • 10/21/2026
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Server Infrastructure component of Oracle Siebel CRM Deployment, specifically affecting supported versions ranging from 17.0 through 26.9. This flaw represents a significant security risk for organizations relying on this enterprise customer relationship management platform, as it undermines the integrity and confidentiality of critical business data managed by the system. The vulnerability is classified with a CVSS 3.1 Base Score of 6.0, indicating a medium severity level that nonetheless demands immediate attention due to its potential impact on core operational functions.
The technical nature of this flaw allows for exploitation by an attacker who already possesses high-level privileges and valid logon credentials within the infrastructure where Siebel CRM Deployment executes. This requirement for local or network-adjacent access with elevated permissions suggests that the vulnerability likely stems from improper privilege separation, insufficient input validation in administrative interfaces, or a logic error in how the deployment service handles requests from authenticated users. Unlike remote code execution vulnerabilities that can be exploited by unauthenticated external actors, this issue requires an insider threat scenario or a compromised high-privileged account to trigger the exploit condition.
From an operational perspective, successful exploitation of this vulnerability enables unauthorized creation, deletion, or modification of critical data within the Siebel CRM Deployment environment. Furthermore, it grants attackers complete access to all data accessible by the deployment service. This capability effectively allows for comprehensive data exfiltration and tampering, which can lead to severe business disruptions, regulatory non-compliance, and loss of customer trust. The impact on confidentiality is high, as sensitive client information may be exposed, while the impact on integrity is also high, allowing attackers to alter records in ways that could distort business analytics or operational workflows.
In terms of industry standard classifications, this vulnerability aligns with CWE-269, which addresses Improper Privilege Management, and potentially CWE-732, if it involves incorrect permission assignment for critical resources. The attack vector corresponds to ATT&CK technique T1078, Valid Accounts, as the exploitation relies on legitimate credentials held by a privileged user. Additionally, actions involving data modification fall under ATT&CK tactic TA0043, Impact, specifically relating to Data Manipulation and Inhibit System Recovery if backups are targeted or corrupted during the attack sequence.
Mitigation strategies should prioritize strict access control policies within the Siebel CRM infrastructure. Organizations must enforce the principle of least privilege, ensuring that no single account has excessive permissions beyond what is strictly necessary for its function. Regular auditing of privileged accounts and monitoring for anomalous activities by high-privileged users are essential steps to detect potential exploitation attempts early. Additionally, applying the latest security patches provided by Oracle for versions 17.0 through 26.9 is critical to addressing this specific flaw in the Server Infrastructure component. Implementing multi-factor authentication for administrative access and segmenting network zones can further reduce the risk of an attacker gaining the required high-privileged logon status needed to exploit this vulnerability.