CVE-2026-91378 exposes the Siebel CRM Integration component within Oracle Siebel CRM, permitting an unauthenticated attacker who can communicate over HTTP to compromise the application. Successful exploitation requires a user interface interaction and follows a human interaction model, but the attacker does not need any credentials. The vulnerability allows the attacker to update, insert, or delete data within the integration module, as well as read restricted data, thereby compromising both integrity and confidentiality of sensitive information.

Oracle Corporation’s Siebel CRM Integration, specifically the Open Integration component, is the affected product. All versions from 25.12 to 26.9 are vulnerable. The impact may extend beyond the integration module to other Siebel CRM products due to its integrated architecture.

The CVSS v3.1 Base Score is 6.1, reflecting moderate severity with defined confidentiality and integrity impacts. The attack vector is over the network via HTTP, with low attack complexity, no privileges required, and requires user interaction. The vulnerability has not been listed in CISA’s KEV catalog, suggesting limited public exploitation at present. Nevertheless, because the flaw permits unauthorized data modification and disclosure, it remains a notable risk for organizations running the vulnerable component, especially if exposed to untrusted networks.