Description
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel CRM Deployment accessible data as well as unauthorized read access to a subset of Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
Published: 2026-10-20
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data modification and disclosure in Siebel CRM Deployment via unauthenticated HTTP access
Action: Apply Patch
AI Analysis

Impact

An unauthenticated attacker with network access can reach Siebel CRM Deployment over HTTP and perform unauthorized update, insert, delete, or read operations on data exposed by the server infrastructure. The flaw allows compromise of confidentiality and integrity of some data without requiring authentication.

Affected Systems

Oracle Siebel CRM Deployment versions 17.0 through 26.9 are affected.

Risk and Exploitability

The CVSS base score of 6.5 indicates a medium severity vulnerability, with the attack vector being network-based and requiring no privileged access. The absence of an EPSS score and the fact that the flaw is not listed in CISA’s KEV catalog suggest that there are no publicly confirmed exploits, but the ease of exploitation via HTTP makes the risk moderate to high for organizations that expose these interfaces to external networks.

Generated by OpenCVE AI on October 21, 2026 at 13:28 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the security update released by Oracle for all affected Siebel CRM Deployment versions up to 26.9.
  • Restrict network access to the server infrastructure by limiting exposure to trusted hosts, using firewall rules or VPNs, and removing unnecessary public HTTP routes.
  • Enforce HTTPS and disable or block the vulnerable HTTP endpoints if the patch cannot be applied immediately.

Generated by OpenCVE AI on October 21, 2026 at 13:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 04 Nov 2026 02:15:00 +0000

Type Values Removed Values Added
First Time appeared Oracle siebel Crm
CPEs cpe:2.3:a:oracle:siebel_crm:*:*:*:*:*:*:*:*
Vendors & Products Oracle siebel Crm

Fri, 23 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 13:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Data Modification and Disclosure in Oracle Siebel CRM Deployment
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel CRM Deployment accessible data as well as unauthorized read access to a subset of Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
First Time appeared Oracle
Oracle siebel Crm Deployment
CPEs cpe:2.3:a:oracle:siebel_crm_deployment:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle siebel Crm Deployment
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

Oracle Siebel Crm Siebel Crm Deployment
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-23T20:27:13.311Z

Reserved: 2026-09-14T22:10:16.635Z

Link: CVE-2026-91440

cve-icon Vulnrichment

Updated: 2026-10-23T20:27:01.693Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:47.550

Modified: 2026-11-04T02:04:05.740

Link: CVE-2026-91440

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T18:30:13Z

Weaknesses