CVE-2026-91387: Medium severity Oracle Siebel CRM End User vulnerability
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel CRM End User accessible data as well as unauthorized read access to a subset of Siebel CRM End User accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
Affected Software
Event History
Frequently Asked Questions
Which deployments should be prioritized for review?
Prioritize Oracle Siebel CRM End User deployments using the Open UI component on supported versions 17.0 through 26.9, particularly where the application is reachable over HTTP by low-privileged users.
Is unauthenticated exploitation indicated?
No. The vulnerability requires low-privileged access; the CVSS vector specifies PR:L and does not indicate a user-interaction requirement.
Does the issue create an availability risk?
No availability impact is indicated. The documented impact is limited to unauthorized read access to a subset of accessible data and unauthorized update, insert, or delete actions against some accessible data.