CVE-2026-91448 in Siebel CRM Deployment
Summary
by MITRE • 10/21/2026
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Server Infrastructure component of Oracle Siebel CRM Deployment, specifically affecting supported versions ranging from 17.0 through 26.9. This security flaw represents a critical weakness in the application's authentication and access control mechanisms, allowing for unauthorized interaction with sensitive backend systems. The nature of this defect is particularly severe because it does not require any form of user intervention or prior credentials to be exploited. An attacker can initiate an attack simply by establishing network connectivity to the target system via standard HTTP protocols. This lack of required pre-authentication significantly lowers the barrier to entry for malicious actors, enabling remote exploitation without the need for social engineering or physical access to the endpoint devices involved in the communication chain.
From a technical perspective, this vulnerability is classified as an unauthenticated injection or improper authorization flaw that permits direct compromise of the Siebel CRM Deployment environment. The attacker leverages network-accessible HTTP endpoints to send crafted requests that bypass intended security checks. Because the vulnerability allows for complete access to all data accessible by the deployment service, it effectively neutralizes the confidentiality guarantees provided by the system's architecture. This aligns with common weakness enumerations related to broken access control and improper authentication mechanisms, where the application fails to properly verify identity or permissions before processing sensitive requests. The ease of exploitation combined with the high impact on data integrity underscores a fundamental design flaw in how the server infrastructure handles incoming network traffic from untrusted sources.
The operational impact of this vulnerability is substantial, primarily centered around the total compromise of data confidentiality within the Siebel CRM Deployment ecosystem. A successful exploit grants an unauthorized attacker unrestricted visibility into critical business data stored or processed by the system. This includes customer records, financial information, and other proprietary assets that are central to enterprise operations. The CVSS 3.1 base score of 7.5 reflects this high severity, driven entirely by the confidentiality impact vector while noting no immediate direct impact on integrity or availability in the baseline scoring model. However, in practical scenarios, access to such critical data often serves as a stepping stone for further attacks, including lateral movement within the network, privilege escalation, and potential denial of service through resource exhaustion or data destruction. The ability to read all accessible data poses significant risks related to regulatory compliance violations, intellectual property theft, and reputational damage for organizations relying on Oracle Siebel CRM for their customer relationship management needs.
To mitigate this risk, immediate action is required to patch the affected versions of Oracle Siebel CRM Deployment to the latest available security updates provided by Oracle. Organizations should verify that all instances running version 17.0 through 26.9 are updated according to the vendor's official guidance. In addition to applying patches, implementing network-level controls such as web application firewalls can help detect and block malicious HTTP requests targeting these vulnerable endpoints before they reach the application server. It is also advisable to restrict direct internet access to Siebel CRM Deployment interfaces by placing them behind secure proxies or internal networks with strict firewall rules that limit exposure to only authorized IP ranges. Regular security audits and penetration testing should be conducted to ensure that no other unauthenticated entry points exist within the infrastructure, thereby reducing the overall attack surface and enhancing the resilience of the deployment environment against similar exploitation attempts.