CVE-2026-91431: Medium severity Oracle Siebel CRM End User vulnerability
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM End User executes to compromise Siebel CRM End User. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM End User accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this vulnerability?
Deployments running the affected Open UI component in Oracle Siebel CRM End User versions 17.0 through 26.9 are exposed. Exploitation requires a low-privileged account with logon access to the infrastructure where the product executes.
Does an attacker need user interaction or remote network access?
No user interaction is required. The CVSS vector identifies the attack vector as local, so the attacker needs access to the relevant infrastructure rather than only remote network reachability.
What is the likely impact if exploitation succeeds?
A successful attack can provide unauthorized access to critical data or complete access to all data accessible to Siebel CRM End User. The stated impact is confidentiality only; integrity and availability impacts are not identified.