CVE-2026-91445 in Siebel CRM End User
Summary
by MITRE • 10/21/2026
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Communications Panel/Dashboard). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM End User accessible data as well as unauthorized update, insert or delete access to some of Siebel CRM End User accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Communications Panel and Dashboard components of Oracle Siebel CRM, specifically affecting end-user versions ranging from 17.0 through 26.9. This security flaw represents a critical weakness in the application's access control mechanisms, allowing for unauthorized interaction with sensitive system resources. The core technical issue stems from insufficient validation or authorization checks within the HTTP-based communication channels utilized by these specific dashboard modules. Because the vulnerability is easily exploitable and does not require any form of authentication, it effectively bypasses the standard security perimeter that protects user-specific data and administrative functions. An attacker positioned on a network with access to the Siebel CRM interface can leverage this flaw without needing valid credentials or prior interaction from a legitimate user, marking it as an unauthenticated remote code execution vector in terms of data manipulation rather than system command execution.
From a technical perspective, the absence of proper authentication checks allows malicious actors to issue HTTP requests that directly interact with backend database operations associated with the Communications Panel and Dashboard features. This lack of enforcement means that sensitive queries or update commands intended for authenticated users can be executed by any external entity capable of reaching the application server over standard web protocols. The vulnerability aligns closely with CWE-862, which describes Missing Authorization, as well as CWE-306, where a critical step in authentication is omitted entirely. By exploiting this gap, an attacker gains the ability to traverse data boundaries that should be strictly enforced by role-based access controls inherent to enterprise CRM systems. The ease of exploitation suggests that automated scanning tools or simple script-based attacks could successfully identify and exploit this weakness across multiple instances simultaneously, increasing the risk of widespread compromise within organizations relying on these supported versions.
The operational impact of this vulnerability is severe due to its high confidentiality and integrity implications as reflected in the CVSS 3.1 base score of 8.2. Successful exploitation grants an unauthenticated attacker unauthorized access to critical data stored within Siebel CRM, including customer records, sales pipelines, communication logs, and potentially proprietary business intelligence aggregated by the dashboard components. Beyond mere observation, the vulnerability permits unauthorized updates, inserts, or deletions against accessible data sets. This capability allows for significant integrity violations where attackers can alter transactional history, fabricate leads, delete critical contact information, or inject malicious content into customer communications. Such actions not only compromise data accuracy but also undermine trust in the system's reliability and can lead to substantial financial loss, regulatory non-compliance under frameworks like GDPR or HIPAA if personal identifiable information is exposed or altered, and reputational damage for the affected organization.
In terms of threat modeling, this vulnerability maps directly to MITRE ATT&CK technique T1078, Valid Accounts, although in this specific case it applies even more critically because no valid account is required at all, effectively bypassing identity verification entirely. It also relates to T1530, Data from Local System, as the attacker extracts sensitive information from the local application environment without authorization. The attack vector falls under Network (AV:N) with Low Complexity (AC:L), indicating that specialized conditions or user interaction are not necessary for exploitation. This simplicity makes it a high-priority target for opportunistic attackers seeking to pivot into deeper network segments after gaining initial foothold through exposed enterprise applications.
Mitigation strategies must focus on immediate remediation and compensating controls until patches can be applied. The primary recommendation is to apply the latest security updates provided by Oracle that address this specific flaw in the Communications Panel and Dashboard components for all affected versions between 17.0 and 26.9. Organizations should verify their current version against Oracle's official support matrix to ensure they are running a patched release. In scenarios where immediate patching is not feasible due to operational constraints, network-level mitigations become essential. Implementing strict firewall rules to restrict access to the Siebel CRM interface solely from trusted IP ranges can significantly reduce the attack surface. Additionally, deploying Web Application Firewalls with specific rule sets designed to detect and block anomalous HTTP requests targeting dashboard endpoints may help mitigate exploitation attempts by identifying patterns consistent with unauthorized data retrieval or modification operations. Regular security audits and penetration testing focused on authentication bypasses should also be conducted to ensure no other similar weaknesses exist within the application architecture.