CVE-2026-91446 in Siebel CRM Deployment
Summary
by MITRE • 10/21/2026
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in takeover of Siebel CRM Deployment. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Server Infrastructure component of Oracle Siebel CRM Deployment, specifically affecting supported versions ranging from 17.0 through 26.9. This security flaw represents a significant risk to organizations relying on this enterprise customer relationship management platform for critical business operations. The nature of the defect allows an attacker who has already gained high-privileged access and authenticated logon credentials to the infrastructure hosting the Siebel CRM Deployment service to exploit the weakness directly. Unlike vulnerabilities that require user interaction or remote network exploitation, this issue is classified as locally exploitable with low complexity, meaning that once an adversary breaches the perimeter and obtains elevated privileges on the host system, they can trigger the vulnerability without additional prerequisites such as social engineering or complex payload construction.
From a technical perspective, the flaw enables privilege escalation leading to complete control over the Siebel CRM Deployment application layer. The CVSS 3.1 base score of 6.7 reflects substantial impacts across all three pillars of the security triad: confidentiality, integrity, and availability. The vector string AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H indicates that while the attack requires local access and high privileges initially, the resulting compromise is severe. An attacker achieving successful exploitation can read sensitive data stored within the deployment environment, modify configuration settings or application logic to alter business processes, and disrupt service availability by crashing critical components of the Siebel infrastructure. This level of control effectively results in a total takeover of the Siebel CRM Deployment instance, allowing the adversary to manipulate customer data, inject malicious code into deployment scripts, or use the compromised system as a pivot point for further lateral movement within the corporate network.
In terms of industry classification standards, this vulnerability aligns with CWE-269 Improper Privilege Management and potentially CWE-78 OS Command Injection if the underlying mechanism involves improper sanitization of inputs passed to operating system commands during deployment operations. From an adversary behavior perspective, it maps closely to MITRE ATT&CK techniques related to Local Privilege Escalation such as T1068 Exploitation for Privilege Escalation and potentially T1543 Create or Modify System Process if the exploitation involves installing persistent backdoors via the deployment infrastructure. The high impact on confidentiality, integrity, and availability underscores that this is not merely a nuisance but a critical threat vector capable of causing significant operational disruption and data breach consequences.
Mitigation strategies must prioritize immediate patching to the latest available version provided by Oracle for Siebel CRM Deployment within the 17.0-26.9 range. Organizations should verify their current deployment versions against Oracle Security Alerts to ensure they are not running vulnerable builds. In addition to applying patches, administrators should enforce strict least privilege principles on all servers hosting Siebel components. This includes restricting administrative access to only those individuals who absolutely require it and ensuring that service accounts used by the application do not possess unnecessary local administrator rights or write permissions outside of designated directories. Network segmentation is also critical; even though this vulnerability requires local access, isolating database and application tiers from general user workstations reduces the attack surface for initial compromise attempts that could lead to privilege escalation. Regular auditing of authentication logs and monitoring for unusual process creation events on deployment servers can help detect exploitation attempts early before full system takeover occurs.