CVE-2026-91450 in Siebel CRM Deployment
Summary
by MITRE • 10/21/2026
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Server Infrastructure component of Oracle Siebel CRM Deployment, specifically affecting supported versions ranging from 17.0 through 26.9. This security flaw represents a significant risk to organizations relying on this enterprise customer relationship management platform for critical business operations and data storage. The core nature of the issue is an authentication bypass or insufficient access control mechanism that allows unauthenticated actors to interact with sensitive backend services via standard HTTP protocols. Despite being classified as difficult to exploit, which implies certain environmental constraints or specific trigger conditions are required, the potential impact remains severe due to the high privilege level granted upon successful exploitation. The vulnerability enables attackers who have network access to the target system to compromise the integrity and confidentiality of the deployment environment without needing valid credentials.
From a technical perspective, this flaw aligns with CWE-287 Improper Authentication or CWE-862 Missing Authorization, depending on whether the issue stems from failing to verify identity before granting access or failing to check permissions for specific actions after authentication is theoretically bypassed. The attacker leverages HTTP requests to interact directly with exposed endpoints that should be restricted to authenticated administrators or authorized users. By manipulating these inputs, an unauthenticated user can execute commands or queries that modify the state of the Siebel CRM Deployment system. This capability allows for unauthorized creation, deletion, or modification of critical data stored within the application database. Such actions undermine the integrity of business records, potentially leading to financial loss, regulatory non-compliance, and reputational damage if sensitive customer information is altered or destroyed maliciously.
The operational impact extends beyond mere data manipulation to include complete access to all Siebel CRM Deployment accessible data. This level of compromise facilitates unauthorized access to critical data such as client contact details, sales pipelines, service history, and internal communications. In the context of industry frameworks like MITRE ATT&CK, this vulnerability maps closely to techniques involving Initial Access via valid accounts or exploitation of application vulnerabilities, followed by Data Exfiltration and Impact through Data Manipulation. The ability to read all accessible data constitutes a high-severity breach of confidentiality, while the capacity to modify or delete records represents a critical failure in integrity controls. Attackers could use this access to plant backdoors, exfiltrate intellectual property, or disrupt business continuity by corrupting essential operational datasets.
The CVSS 3.1 base score of 7.4 reflects these substantial impacts on confidentiality and integrity while noting that availability is not directly affected by this specific vector. The vector string (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates a network-based attack with high complexity, no required user interaction, and no privilege requirement prior to exploitation. Although the high complexity suggests that automated scanning tools may not easily detect or exploit this flaw without precise payload construction, manual exploitation by skilled adversaries remains feasible. The scope is unchanged, meaning the impact is confined to the vulnerable component rather than escalating to other system resources, but within those boundaries, the damage potential is extensive.
Mitigation strategies must prioritize immediate patching of Oracle Siebel CRM Deployment to the latest available version that addresses this specific Server Infrastructure flaw. Organizations should verify their current deployment versions against the supported range and apply vendor-provided patches as soon as they are released. In environments where patching cannot be implemented immediately, network-level controls such as Web Application Firewalls (WAF) can be configured to detect and block anomalous HTTP requests that attempt to access restricted endpoints or exhibit patterns consistent with exploitation attempts for this vulnerability. Additionally, implementing strict input validation on the server side and enforcing robust authentication checks before processing any administrative commands are essential defensive measures. Regular security assessments and penetration testing should include specific scenarios targeting unauthenticated access to critical data stores to ensure these controls remain effective against evolving attack techniques.