CVE-2026-91442 in Siebel CRM Deployment
Summary
by MITRE • 10/21/2026
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in takeover of Siebel CRM Deployment. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Server Infrastructure component of Oracle Siebel CRM Deployment, specifically affecting supported versions ranging from 17.0 through 26.9. This security flaw represents a critical risk to enterprise customer relationship management environments that rely on this platform for managing complex business processes and sensitive client data. The presence of such a vulnerability in the core server infrastructure indicates a fundamental weakness in how the application handles incoming requests or manages internal state, potentially allowing an adversary to bypass standard authentication mechanisms or exploit improper access controls inherent in the deployment architecture.
From a technical perspective, this flaw is characterized by its ease of exploitation and low barrier to entry for attackers. A threat actor with low privileges who possesses network access via HTTP can leverage this vulnerability to achieve complete compromise of the Siebel CRM Deployment environment. The use of HTTP rather than HTTPS suggests that the attack vector may involve unencrypted communication channels or a failure in transport layer security validation, although the primary issue lies within the application logic itself. The ability for low-privileged users to execute such an exploit highlights significant deficiencies in role-based access control and input validation processes within the server infrastructure.
The operational impact of this vulnerability is severe, as evidenced by its CVSS 3.1 Base Score of 8.8, which classifies it as High severity with a vector indicating network accessibility, low complexity, no user interaction required, and unchanged scope. The high scores across confidentiality, integrity, and availability indicate that successful exploitation leads to full system takeover. This means an attacker can read sensitive customer data, modify critical business configurations or records, and disrupt service operations by crashing the deployment instance. Such comprehensive compromise undermines the trustworthiness of the entire CRM ecosystem, potentially leading to significant financial loss, regulatory non-compliance, and reputational damage for organizations dependent on Oracle Siebel CRM.
In terms of industry standard classifications, this vulnerability aligns with CWE-269 Improper Privilege Escalation or CWE-732 Incorrect Permission Assignment for Critical Resource, as it allows a lower privileged user to gain higher levels of access than intended. Furthermore, the attack pattern corresponds to MITRE ATT&CK techniques related to Initial Access via valid accounts and potentially Lateral Movement if the compromised deployment serves as a pivot point within the network. The lack of required user interaction places this firmly in automated exploitation scenarios, increasing the likelihood of widespread compromise through scanning tools or worm-like propagation mechanisms targeting exposed HTTP endpoints.
Mitigation strategies must prioritize immediate remediation given the high severity and ease of exploitation. Organizations should apply the latest security patches provided by Oracle for their specific version of Siebel CRM Deployment to address the underlying code flaws in the server infrastructure component. In environments where patching is not immediately feasible, network segmentation policies should be enforced to restrict HTTP access to the deployment servers from untrusted networks or low-privileged user segments. Additionally, implementing strict input validation and enforcing HTTPS-only connections can reduce the attack surface by ensuring that all communications are encrypted and authenticated through more robust protocols than plain HTTP. Regular vulnerability assessments and penetration testing focused on privilege escalation paths should be conducted to identify similar weaknesses in other components of the CRM infrastructure before they can be exploited by malicious actors seeking full system control.