Description
Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Integration - Scripting). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with network access via CORBA to compromise Siebel CRM Development. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel CRM Development as well as unauthorized update, insert or delete access to some of Siebel CRM Development accessible data and unauthorized read access to a subset of Siebel CRM Development accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H).
Published: 2026-10-20
Score: 6 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service and Unauthorized Data Modification
Action: Apply Patch
AI Analysis

Impact

A vulnerability exists in the Integration – Scripting component of Oracle Siebel CRM Development that allows a high privilege attacker with network access via CORBA to execute arbitrary script operations. Successful exploitation can lead to a complete denial of service by repeatedly crashing the application, as well as unauthorized update, insertion, deletion, and read of data that the user normally has no access to, affecting confidentiality, integrity, and availability.

Affected Systems

Oracle Siebel CRM Development, Component: Integration – Scripting, Versions 17.0 to 26.9 are affected. The attack requires an attacker to possess high level privileges and be able to reach the system over the network using CORBA.

Risk and Exploitability

The CVSS base score of 6.0 indicates a moderate severity with potential Confidentiality, Integrity and Availability impact. Because the exploit is deemed “easily exploitable” and requires only network access to CORBA, the likelihood of attack is significant for environments that expose these interfaces. The vulnerability is not currently listed in CISA’s KEV catalog and no EPSS score is available, but the high privilege requirement and ability to cause a full crash make it a critical concern for exposed deployments.

Generated by OpenCVE AI on October 21, 2026 at 10:12 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply Oracle Siebel CRM patch or upgrade to a version that contains the fix.
  • Restrict network access to CORBA endpoints by configuring firewalls or access control lists.
  • Disable the scripting component or limit its use to strictly necessary functions.
  • Monitor application logs for abnormal scripting activity and enforce audit trails.

Generated by OpenCVE AI on October 21, 2026 at 10:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 04 Nov 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Oracle siebel Crm
CPEs cpe:2.3:a:oracle:siebel_crm:*:*:*:*:*:*:*:*
Vendors & Products Oracle siebel Crm

Fri, 23 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 10:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification and Denial of Service via CORBA Scripting in Oracle Siebel CRM Development
Weaknesses CWE-284
CWE-285
CWE-400

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Integration - Scripting). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with network access via CORBA to compromise Siebel CRM Development. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel CRM Development as well as unauthorized update, insert or delete access to some of Siebel CRM Development accessible data and unauthorized read access to a subset of Siebel CRM Development accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H).
First Time appeared Oracle
Oracle siebel Crm Development
CPEs cpe:2.3:a:oracle:siebel_crm_development:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle siebel Crm Development
References
Metrics cvssV3_1

{'score': 6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H'}

Subscriptions

Oracle Siebel Crm Siebel Crm Development
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-23T20:01:28.704Z

Reserved: 2026-09-14T22:10:16.633Z

Link: CVE-2026-91413

cve-icon Vulnrichment

Updated: 2026-10-23T20:01:24.061Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:44.710

Modified: 2026-11-04T16:55:23.467

Link: CVE-2026-91413

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T18:00:08Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-285

    Improper Authorization

  • CWE-400

    Uncontrolled Resource Consumption