CVE-2026-91439 in Siebel CRM Deployment
Summary
by MITRE • 10/21/2026
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The identified vulnerability resides within the Server Infrastructure component of Oracle Siebel CRM Deployment, specifically affecting supported versions ranging from 17.0 through 26.9. This security flaw represents a significant risk to organizations relying on this customer relationship management platform for critical business operations. The core issue stems from an improper access control mechanism that fails to adequately restrict data retrieval or manipulation based on user privileges. While the vulnerability requires authentication, it does not demand high-level administrative credentials, thereby lowering the barrier for exploitation significantly compared to typical privilege escalation attacks.
An attacker with low-privileged account access who has successfully logged into the infrastructure where Siebel CRM Deployment executes can exploit this flaw to compromise the integrity and confidentiality of the system. The technical nature of the vulnerability allows an authenticated user to bypass intended security restrictions, enabling them to access data that should be restricted to higher-level roles or other users entirely. This misalignment between assigned privileges and actual permissions creates a direct pathway for unauthorized information disclosure without requiring complex exploitation techniques or social engineering efforts.
The operational impact of this vulnerability is primarily centered on the compromise of confidentiality rather than integrity or availability, as indicated by its CVSS 3.1 base score of 5.5. Successful exploitation results in unauthorized access to critical data stored within the Siebel CRM Deployment environment. In severe cases, an attacker could gain complete access to all accessible data managed by the deployment instance. This exposure poses substantial risks including potential leakage of sensitive customer information, proprietary business strategies, and personal identifiable information which are central to the value proposition of any CRM system.
From a classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Management or potentially CWE-862 Missing Authorization depending on the specific implementation details of how access controls were enforced within the server infrastructure code. The attack vector is classified as Local (AV:L) with Low Complexity (AC:L), requiring no user interaction (UI:N) and maintaining unchanged scope (S:U). This categorization underscores that while physical or network proximity to the execution environment is required, the ease of exploitation remains high once local access is established through a low-privileged account.
Mitigation strategies must prioritize immediate patching by Oracle for all affected versions within the 17.0 to 26.9 range. Organizations should verify their current deployment version and apply the latest security updates provided by Oracle as soon as they become available. In scenarios where immediate patching is not feasible, implementing strict network segmentation can help isolate Siebel CRM Deployment servers from less trusted networks or user segments. Additionally, enforcing principle of least privilege across all user accounts ensures that even if an attacker gains initial access via a low-privileged account, the potential blast radius remains limited by restricting unnecessary permissions and data exposure pathways until permanent remediation is applied.