CVE-2026-91422: Medium severity Oracle Siebel CRM Deployment vulnerability
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N).
Affected Software
Event History
Frequently Asked Questions
Which deployments should be prioritized for remediation?
Oracle identifies supported Siebel CRM Deployment versions 17.0 through 26.9 as affected. Prioritize instances where the Server Infrastructure component is reachable over HTTP.
What level of access does an attacker need?
An attacker needs network access via HTTP and low-privileged access. User interaction is not required, but Oracle rates exploitation as difficult.
What is the primary impact if exploitation succeeds?
Successful exploitation can allow unauthorized creation, deletion, or modification of critical data or all data accessible to Siebel CRM Deployment. The stated CVSS impact is integrity-only; no confidentiality or availability impact is listed.