CVE-2026-91443: Infoleak
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs network access to the Siebel CRM Deployment environment over HTTP and low-privileged credentials. No user interaction is required.
Which deployments are affected?
Oracle Siebel CRM Deployment Server Infrastructure versions 17.0 through 26.9 are listed as affected.
What is the likely impact of a successful attack?
A successful attacker can gain unauthorized access to critical data, potentially including all data accessible to the Siebel CRM Deployment instance. The stated impact is confidentiality only; no integrity or availability impact is specified.