CVE-2026-91449 in Siebel CRM Deployment
Summary
by MITRE • 10/21/2026
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Server Infrastructure component of Oracle Siebel CRM, specifically affecting deployment versions ranging from 17.0 through 26.9. This security flaw presents a significant risk to organizations relying on this enterprise customer relationship management platform for critical business operations. The core issue stems from an architectural weakness in how the server infrastructure handles incoming HTTP requests without adequate authentication checks or input validation mechanisms. Although the vulnerability is classified as difficult to exploit, it allows unauthenticated attackers who have network access via HTTP to compromise the integrity and confidentiality of the Siebel CRM Deployment environment. This classification indicates that while exploitation requires specific conditions or precise timing, the potential impact on data security remains severe once successful execution occurs.
From a technical perspective, this vulnerability aligns with CWE-287, which describes Improper Authentication, as well as aspects of CWE-601 URL Redirection to Untrusted Site (Open Redirect) if the attack vector involves redirecting users or requests to malicious endpoints. The attacker leverages network access over HTTP to send crafted requests that bypass standard authentication protocols. Because the vulnerability allows for unauthorized creation, deletion, or modification of critical data, it directly impacts the integrity of the system. Furthermore, the ability to gain complete access to all Siebel CRM Deployment accessible data signifies a catastrophic breach of confidentiality. The CVSS 3.1 base score of 7.4 reflects these high-impact consequences on both confidentiality and integrity, while availability remains unaffected according to the provided vector string (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
In terms of operational impact, a successful exploitation could lead to substantial business disruption and regulatory non-compliance. Attackers could exfiltrate sensitive customer information, modify transactional records, or delete essential configuration data required for the CRM system's operation. This level of access effectively grants an attacker full control over the affected deployment instances without needing valid credentials. The difficulty in exploiting this vulnerability suggests that automated scanning tools might not easily detect it, requiring more sophisticated manual testing techniques to identify and exploit the flaw. Consequently, organizations must remain vigilant against targeted attacks rather than relying solely on broad-spectrum security scans for detection.
To mitigate these risks, immediate action is required by applying the latest security patches provided by Oracle for the affected Siebel CRM versions. Organizations should also implement network-level controls such as Web Application Firewalls to inspect and filter HTTP traffic for suspicious patterns associated with this vulnerability type. Additionally, enforcing strict access control policies and ensuring that all administrative interfaces are not directly exposed to untrusted networks can reduce the attack surface. Regular security assessments and penetration testing focused on authentication bypasses and data manipulation flaws will help identify similar weaknesses before they can be exploited by malicious actors. Monitoring logs for unusual HTTP request patterns originating from external sources is also recommended as a defensive measure against potential exploitation attempts.