Description
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 5.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N).
Published: 2026-10-20
Score: 5.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Access
Action: Patch
AI Analysis

Impact

The vulnerability resides in the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications. Remote attackers who can reach the application over HTTP, without authentication, can read protected data. This flaw represents an Information Exposure weakness (CWE-200) and may also be considered an Improper Authorization weakness (CWE-284), allowing unauthorized read access to a subset of data that should be confidential, potentially exposing sensitive business information.

Affected Systems

Oracle Siebel CRM Cloud Applications, versions 22.3 through 26.9, including the Siebel Cloud Manager component, are affected. These versions are deployed in the cloud-based CRM platform and may also impact related modules due to the scope change indicated by the CVSS S:C.

Risk and Exploitability

With a CVSS v3.1 base score of 5.8 the vulnerability presents a moderate confidentiality risk. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread known exploitation yet. The attack requires only network access to HTTP endpoints, making it easily exploitable by unauthenticated users. The scope change means that a successful read could also affect associated applications, increasing the overall risk.

Generated by OpenCVE AI on October 21, 2026 at 13:34 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch that resolves CVE-2026-91371 to all affected Siebel CRM Cloud Applications instances.
  • Restrict access to the Siebel Cloud Manager endpoints by enabling authentication, using VPN or IP whitelisting, and ensuring the application is not exposed to the public internet without protection.
  • Enable detailed logging for all HTTP requests to the Siebel Cloud Manager and regularly audit logs for unauthenticated access attempts.

Generated by OpenCVE AI on October 21, 2026 at 13:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 04 Nov 2026 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Oracle siebel Crm
CPEs cpe:2.3:a:oracle:siebel_crm:*:*:*:*:*:*:*:*
Vendors & Products Oracle siebel Crm

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Read Access in Siebel CRM Cloud Manager
Weaknesses CWE-200
CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 5.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N).
First Time appeared Oracle
Oracle siebel Crm Cloud Applications
CPEs cpe:2.3:a:oracle:siebel_crm_cloud_applications:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle siebel Crm Cloud Applications
References
Metrics cvssV3_1

{'score': 5.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N'}

Subscriptions

Oracle Siebel Crm Siebel Crm Cloud Applications
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-21T15:52:10.744Z

Reserved: 2026-09-14T22:10:16.630Z

Link: CVE-2026-91371

cve-icon Vulnrichment

Updated: 2026-10-21T15:52:00.820Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:40.070

Modified: 2026-11-04T14:19:28.170

Link: CVE-2026-91371

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T14:45:14Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control