CVE-2026-91440 in Siebel CRM Deployment
Summary
by MITRE • 10/21/2026
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel CRM Deployment accessible data as well as unauthorized read access to a subset of Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Server Infrastructure component of Oracle Siebel CRM, specifically affecting deployment versions ranging from 17.0 through 26.9. This security flaw is classified as a critical weakness in the application layer that permits unauthenticated attackers to exploit the system over standard HTTP network connections. The absence of required authentication checks for specific endpoints or API calls allows external actors with basic network access to interact directly with vulnerable services without providing valid credentials, thereby bypassing fundamental identity verification mechanisms designed to protect sensitive enterprise data and configuration settings.
From a technical perspective, this vulnerability represents an authorization failure where the application fails to properly enforce access controls on certain administrative or management functions within the Siebel CRM Deployment architecture. The flaw enables attackers to perform unauthorized operations including updates, inserts, and deletes against accessible data stores, as well as reading subsets of protected information. This behavior aligns with CWE-269 Improper Privilege Management and CWE-862 Missing Authorization, indicating that the software does not adequately verify whether a user has the necessary permissions before executing actions or revealing sensitive content. The exploitation vector is straightforward due to its network accessibility via HTTP, which requires no special conditions such as user interaction or complex preconditions beyond basic connectivity to the target service.
The operational impact of this vulnerability is significant for organizations relying on Siebel CRM for customer relationship management and business process automation. Successful exploitation can lead to both confidentiality breaches and integrity violations within a CVSS 3.1 base score context rated at 6.5, reflecting medium severity driven by combined impacts on data secrecy and system modification capabilities. Attackers could potentially exfiltrate sensitive customer records, financial details, or proprietary business logic through unauthorized read access. Simultaneously, the ability to modify, insert, or delete data poses a severe risk of operational disruption, data corruption, or persistent backdoor installation if attackers manipulate configuration files or user accounts. This dual impact on confidentiality and integrity undermines trust in the system's reliability and compliance with regulatory standards such as GDPR or HIPAA that mandate strict access controls over personal and sensitive information.
In terms of threat modeling, this vulnerability maps to MITRE ATT&CK techniques involving Initial Access via valid credentials if authentication was partially bypassed, though here it is unauthenticated so it falls under T1078 Valid Accounts exploitation patterns where default or weak configurations are leveraged, or more accurately T1190 Exploit Public-Facing Application. The lack of network-based access control lists (ACLs) or web application firewall rules to restrict HTTP traffic from unauthorized sources exacerbates the risk. Organizations must recognize that exposing Siebel CRM infrastructure components directly to networks without robust perimeter defenses creates an attack surface ripe for automated scanning and exploitation by malicious actors seeking quick wins against poorly secured enterprise applications.
Mitigation strategies should prioritize immediate patching of Oracle Siebel CRM to the latest supported version where this Server Infrastructure flaw has been resolved, as vendor patches typically address underlying code logic errors related to access control validation. In environments where immediate patching is not feasible due to operational constraints, network segmentation and strict firewall rules must be implemented to restrict HTTP traffic to the vulnerable components exclusively from trusted internal IP ranges or management networks. Additionally, deploying a Web Application Firewall with specific rule sets designed to detect anomalous API calls or unauthorized data manipulation attempts can provide an additional layer of defense. Regular security audits focusing on authentication mechanisms and role-based access control configurations are essential to ensure that no other endpoints within the Siebel deployment share similar weaknesses. Monitoring logs for unusual patterns of unauthenticated requests resulting in data changes will also aid in early detection of exploitation attempts, allowing incident response teams to react before significant damage occurs.