CVE-2026-91435: Medium severity Oracle Siebel CRM Deployment vulnerability
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel CRM Deployment. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Siebel CRM Deployment Server Infrastructure installations running supported affected versions 17.0 through 26.9 are exposed if a low-privileged account can reach the product over HTTP.
What does an attacker need to exploit it?
An attacker needs network access via HTTP and low-privileged credentials. No user interaction is required, and the vulnerability is described as easily exploitable.
What is the expected impact of successful exploitation?
Successful exploitation can cause Siebel CRM Deployment to hang or repeatedly crash, resulting in a complete denial of service. The stated impact is limited to availability; no confidentiality or integrity impact is listed.
How can I determine whether my deployment is affected?
Verify whether the Server Infrastructure component is part of Oracle Siebel CRM Deployment and whether its supported version falls between 17.0 and 26.9. Also assess whether low-privileged users can access the deployment over HTTP.