Description
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel CRM End User, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel CRM End User accessible data as well as unauthorized read access to a subset of Siebel CRM End User accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
Published: 2026-10-20
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Data Modification and Unauthorized Read
Action: Apply Patch
AI Analysis

Impact

The vulnerability is located in the Open UI component of Oracle Siebel CRM End User and allows a low‑privileged attacker with HTTP network access to compromise the system. Successful exploitation requires human interaction from a person other than the attacker. If exploited, the attacker can update, insert, or delete data and read a subset of data that is normally accessible only to authorized users. The weakness involves improper access control, leading to confidentiality and integrity impacts.

Affected Systems

Oracle Siebel CRM End User versions 17.0 through 26.9 are affected. The product is delivered under the name Siebel CRM End User.

Risk and Exploitability

The CVSS 3.1 base score of 5.4 indicates a moderate severity with low confidentiality and integrity impact. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. The likely attack vector is HTTP network access to the Open UI interface with low privilege authentication. The need for a separate human collaborator lowers the ease of exploitation but does not eliminate the risk to data integrity and confidentiality.

Generated by OpenCVE AI on October 21, 2026 at 13:58 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor patch available for all affected versions 17.0-26.9 as detailed in the Oracle CPU October 2026 advisory
  • Restrict external HTTP access to the Siebel CRM End User server using firewalls or ACLs, limiting connections to trusted networks
  • Enforce least‑privilege access controls within the application and validate that only authorized users can perform update, insert, or delete operations

Generated by OpenCVE AI on October 21, 2026 at 13:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 04 Nov 2026 17:30:00 +0000

Type Values Removed Values Added
First Time appeared Oracle siebel Crm
CPEs cpe:2.3:a:oracle:siebel_crm:*:*:*:*:*:*:*:*
Vendors & Products Oracle siebel Crm

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Title Low-Privilege HTTP Exploit in Siebel CRM End User Enables Unauthorized Data Modification
Weaknesses CWE-250
CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel CRM End User, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel CRM End User accessible data as well as unauthorized read access to a subset of Siebel CRM End User accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
First Time appeared Oracle
Oracle siebel Crm End User
CPEs cpe:2.3:a:oracle:siebel_crm_end_user:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle siebel Crm End User
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Oracle Siebel Crm Siebel Crm End User
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-21T15:08:01.708Z

Reserved: 2026-09-14T22:10:16.631Z

Link: CVE-2026-91389

cve-icon Vulnrichment

Updated: 2026-10-21T15:07:56.972Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:42.160

Modified: 2026-11-04T17:18:07.357

Link: CVE-2026-91389

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T19:30:07Z

Weaknesses
  • CWE-250

    Execution with Unnecessary Privileges

  • CWE-284

    Improper Access Control