CVE-2026-91388 describes a vulnerability in the Open UI component of Oracle Siebel CRM End User. An unauthenticated attacker with network access via HTTP can compromise the system. The vulnerability is difficult to exploit and requires human interaction from a party other than the attacker. If an attack succeeds, the attacker may obtain unauthorized read access to a subset of data and unauthorized update, insert or delete access to certain data held in Siebel CRM End User.

Affected systems include Oracle Siebel CRM End User, versions 17.0 through 26.9.

The CVSS 3.1 base score is 4.7 reflecting confidentiality and integrity impacts. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. The attack vector is network via HTTP, but the need for human interaction reduces the likelihood of exploitation. The scope change indicates that compromise could potentially influence other components of the Siebel CRM ecosystem. Overall risk is moderate, with a moderate probability that the vulnerability will be exploited by interested actors.