CVE-2026-91437 in Siebel CRM Deployment
Summary
by MITRE • 10/21/2026
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Siebel CRM Deployment. While the vulnerability is in Siebel CRM Deployment, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Server Infrastructure component of Oracle Siebel CRM Deployment, specifically affecting supported versions ranging from 17.0 through 26.9. This flaw represents a critical security deficiency that allows for unauthorized manipulation of data and system resources due to insufficient access control mechanisms or improper validation of user inputs at the server level. The vulnerability is characterized by its ease of exploitation, requiring only network accessibility via HTTP protocols rather than complex interaction patterns such as social engineering or local physical access. However, it does demand a high privilege level for the attacker prior to execution, indicating that while the technical barrier to exploit the flaw is low once authenticated, initial authentication remains a prerequisite step in the attack chain.
From an operational perspective, this vulnerability poses severe risks to data confidentiality and integrity within the enterprise environment. Successful exploitation enables a high-privileged attacker with network access to compromise the Siebel CRM Deployment system by creating, deleting, or modifying critical data without authorization. Furthermore, it grants unauthorized access to sensitive information that would otherwise be restricted, potentially leading to complete exposure of all accessible deployment data. The impact extends beyond the immediate component due to scope changes inherent in interconnected enterprise architectures; attacks targeting this specific module can significantly affect additional products within the broader Oracle Siebel ecosystem, thereby amplifying the blast radius and complicating incident response efforts across multiple systems.
In terms of industry-standard classification frameworks, this vulnerability aligns with CWE-269 Improper Privilege Management or CWE-862 Missing Authorization, as it involves a high-privileged actor performing actions that should be restricted based on role-based access controls. The ability to modify and delete critical data corresponds closely to CWE-732 Incorrect Permission Assignment for Critical Resource, reflecting the failure to enforce proper security policies on sensitive files or database entries. Within the MITRE ATT&CK framework, this scenario maps primarily to T1078 Valid Accounts, as it relies on legitimate high-privileged credentials being compromised or misused, and potentially T1485 Data Destruction if the deletion capabilities are fully leveraged by an adversary aiming for disruptive impact rather than mere espionage.
The CVSS 3.1 base score of 8.7 reflects a High severity rating driven primarily by significant impacts on confidentiality and integrity while maintaining no direct impact on availability in this specific vector description, although data loss can indirectly affect operational continuity. The vector string (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) confirms that the attack is network-based with low complexity, requires high privileges, involves no user interaction, and exhibits a scope change where impact extends beyond the vulnerable component to other system resources. This combination of factors necessitates urgent attention from security operations teams responsible for maintaining the integrity of customer relationship management platforms.
Mitigation strategies must focus on immediate remediation through applying vendor-provided patches or updates that address the underlying code flaws in the Server Infrastructure module. Organizations should also implement strict network segmentation to limit HTTP access to critical deployment servers, ensuring that only authorized administrative workstations can communicate with these systems over secure channels such as HTTPS rather than plain HTTP where feasible. Additionally, enforcing multi-factor authentication and regularly auditing high-privileged accounts can reduce the likelihood of credential compromise leading to exploitation. Continuous monitoring for anomalous data modification patterns or unauthorized access attempts using SIEM tools will aid in early detection and response should a vulnerability exploit be attempted despite preventive controls.