Description
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel CRM Deployment. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-10-20
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

The vulnerability exists in the Server Infrastructure component of Oracle Siebel CRM Deployment. An unauthenticated attacker who can reach the system over HTTP can trigger a repetitive hang or complete crash, leading to a denial of service. This results in availability loss, with no confidentiality or integrity impact, reflected in the CVSS Base Score of 5.9.

Affected Systems

Affected versions span from 17.0 to 26.9 of Siebel CRM Deployment. The vulnerability applies to the Server Infrastructure component, and Oracle's October 2026 CPU advisory covers this range.

Risk and Exploitability

The CVSS Base Score of 5.9 indicates medium severity. The EPSS is currently unavailable and the vulnerability is not listed in CISA's KEV catalog, implying no known active exploits. However, the lack of authentication and the ability to reach the HTTP interface from any network location that can access the port means the risk is non‑negligible; it is a potential availability attack vector that should be remediated promptly.

Generated by OpenCVE AI on October 21, 2026 at 10:07 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply Oracle's latest security patch for Siebel CRM Deployment as detailed in the Oct 2026 CPU.
  • Restrict the HTTP interface of Siebel CRM Deployment to trusted IP ranges using firewall or ACLs to reduce exposure.
  • Enable application‑level health checks and configure automated restarts or load‑balancer failover to detect and mitigate hangs or crashes caused by the vulnerability.

Generated by OpenCVE AI on October 21, 2026 at 10:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 04 Nov 2026 16:00:00 +0000

Type Values Removed Values Added
First Time appeared Oracle siebel Crm
CPEs cpe:2.3:a:oracle:siebel_crm:*:*:*:*:*:*:*:*
Vendors & Products Oracle siebel Crm

Fri, 23 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 10:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Denial of Service via Hang or Crash in Oracle Siebel CRM Deployment
Weaknesses CWE-400

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel CRM Deployment. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle siebel Crm Deployment
CPEs cpe:2.3:a:oracle:siebel_crm_deployment:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle siebel Crm Deployment
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Siebel Crm Siebel Crm Deployment
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-23T20:06:43.449Z

Reserved: 2026-09-14T22:10:16.633Z

Link: CVE-2026-91421

cve-icon Vulnrichment

Updated: 2026-10-23T20:06:38.419Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:45.527

Modified: 2026-11-04T15:53:12.740

Link: CVE-2026-91421

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T15:45:06Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption