CVE-2026-91388: Medium severity Oracle Siebel CRM End User vulnerability
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel CRM End User, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel CRM End User accessible data as well as unauthorized read access to a subset of Siebel CRM End User accessible data. CVSS 3.1 Base Score 4.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N).
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Oracle identifies supported Siebel CRM End User versions 17.0 through 26.9 as affected, specifically in the Open UI component.
Does an attacker need an account or internal access?
No. The vulnerability can be targeted by an unauthenticated attacker with network access over HTTP, but exploitation is difficult and requires interaction from someone other than the attacker.
What could a successful attack allow?
A successful attack may allow unauthorized read access to a subset of accessible data and unauthorized update, insert, or delete actions on some accessible data. The scope change means impacts may significantly affect additional products.
How can exposure be reduced if remediation cannot be applied immediately?
The available information identifies HTTP network access and required user interaction as exploitation conditions. Reducing unauthenticated HTTP reachability to the affected Open UI and limiting user interaction with untrusted content can reduce exposure.