CVE-2026-91368: Medium severity Oracle Siebel CRM Cloud Applications vulnerability
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 4.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N).
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this vulnerability?
Exposure is limited to deployments of Oracle Siebel CRM Cloud Applications using the Siebel Cloud Manager component on supported affected versions 22.3 through 26.9. Exploitation requires a high-privileged attacker who can log on to the infrastructure where the application runs.
Can an unauthenticated remote attacker exploit this issue?
No. The supplied CVSS vector identifies local access, high privileges, and high attack complexity as requirements; no user interaction is required.
What is the potential impact of successful exploitation?
A successful attack can provide unauthorized access to critical data or complete access to all data accessible through the affected Siebel CRM Cloud Applications deployment. The stated impact is confidentiality only, with no integrity or availability impact listed.
How can I determine whether my environment is affected?
Verify whether Siebel Cloud Manager is deployed in Oracle Siebel CRM Cloud Applications and whether the supported version is in the 22.3-26.9 range. Also assess whether high-privileged users can log on to the infrastructure hosting the application, as this access is required for exploitation.