Description
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel CRM End User accessible data as well as unauthorized read access to a subset of Siebel CRM End User accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
Published: 2026-10-20
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Modification and Disclosure
Action: Immediate Patch
AI Analysis

Impact

A vulnerability exists in the Open UI component of Oracle Siebel CRM End User that permits an unauthenticated attacker with network access via HTTP to perform unauthorized updates, inserts, and deletions of data, as well as unauthorized reads of a subset of accessible data. The issue results in confidentiality and integrity impacts, with a CVSS 3.1 base score of 6.5, reflecting a moderate but significant risk to information security.

Affected Systems

Oracle's Siebel CRM End User product, specifically the Open UI component, is vulnerable for affected releases ranging from version 17.0 through 26.9. Users of these releases should verify their exact installed version to determine applicability.

Risk and Exploitability

The vulnerability is exploitable over the network using standard HTTP, requiring no authentication. While the EPSS score is not available, the CVSS score indicates non‑trivial impact. The vulnerability is not currently listed in the CISA KEV catalog, but its nature allows for straightforward exploitation by any remote actor with network access to the affected system.

Generated by OpenCVE AI on October 21, 2026 at 10:01 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle Security Patch released in CPU Oct 2026 for Siebel CRM End User
  • Restrict external HTTP access to the Siebel CRM End User application by configuring firewalls or network segmentation to limit exposure to trusted devices or networks
  • Implement activity monitoring and audit logging for data modification operations to detect and respond to unauthorized changes

Generated by OpenCVE AI on October 21, 2026 at 10:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 04 Nov 2026 17:00:00 +0000

Type Values Removed Values Added
First Time appeared Oracle siebel Crm
CPEs cpe:2.3:a:oracle:siebel_crm:*:*:*:*:*:*:*:*
Vendors & Products Oracle siebel Crm

Fri, 23 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 10:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Network Exploitation of Siebel CRM End User Data
Weaknesses CWE-284
CWE-285

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel CRM End User accessible data as well as unauthorized read access to a subset of Siebel CRM End User accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
First Time appeared Oracle
Oracle siebel Crm End User
CPEs cpe:2.3:a:oracle:siebel_crm_end_user:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle siebel Crm End User
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

Oracle Siebel Crm Siebel Crm End User
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-23T20:16:59.225Z

Reserved: 2026-09-14T22:10:16.634Z

Link: CVE-2026-91432

cve-icon Vulnrichment

Updated: 2026-10-23T20:16:53.851Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:46.647

Modified: 2026-11-04T16:49:33.810

Link: CVE-2026-91432

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T18:30:13Z

Weaknesses