CVE-2026-91440: Medium severity Oracle Siebel CRM Deployment vulnerability
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel CRM Deployment accessible data as well as unauthorized read access to a subset of Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Oracle identifies supported versions 17.0 through 26.9 of the Siebel CRM Deployment Server Infrastructure component as affected.
Does exploitation require authentication or user interaction?
No. An unauthenticated attacker with network access to the target over HTTP can exploit the issue, and Oracle rates the attack complexity as low with no user interaction required.
What could an attacker do after successful exploitation?
Successful exploitation can provide unauthorized read access to a subset of accessible data and unauthorized update, insert, or delete access to some accessible data. The published CVSS vector indicates confidentiality and integrity impact, with no availability impact.