CVE-2026-91436: Low severity Oracle Siebel CRM Deployment vulnerability
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel CRM Deployment accessible data as well as unauthorized read access to a subset of Siebel CRM Deployment accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Siebel CRM Deployment. CVSS 3.1 Base Score 3.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L).
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this vulnerability?
Exposure is limited to Oracle Siebel CRM Deployment installations running affected supported versions 17.0 through 26.9. Exploitation requires a high-privileged attacker who can log on to the infrastructure where Siebel CRM Deployment executes.
Does this issue affect an attacker without local infrastructure access or elevated privileges?
The provided CVSS vector indicates local attack access, high attack complexity, and high privileges are required. No user interaction is required.
What could a successful attacker do?
A successful attack could allow unauthorized reading of a subset of accessible data, unauthorized updates, inserts, or deletions of some accessible data, and partial denial of service of Siebel CRM Deployment.