Description
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in takeover of Siebel CRM Deployment. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution / Full Compromise
Action: Immediate Patch
AI Analysis

Impact

The vulnerability lies in the server infrastructure component of Oracle Siebel CRM Deployment and permits a low‑privileged attacker with HTTP network access to compromise the system. Successful exploitation results in a full takeover, impacting confidentiality, integrity and availability.

Affected Systems

Oracle Siebel CRM Deployment versions from 17.0 through 26.9 are affected. The vulnerability affects the Server Infrastructure component. Systems running any of these versions deployed in a network environment are at risk.

Risk and Exploitability

The CVSS v3.1 base score of 8.8 indicates high severity, with all three security objectives threatened. The exploit requires only network connectivity over HTTP and low privileges, making it easily exploitable. EPSS <1% indicates a very low but non‑zero exploitation probability, and the vulnerability is not yet listed in the CISA KEV catalog. Prompt remediation remains essential.

Generated by OpenCVE AI on October 24, 2026 at 00:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle patch for Siebel CRM Deployment that addresses CVE-2026-91442 (available through the Oracle Security Alert Oct 2026).
  • Configure network and firewall rules to limit HTTP access to trusted hosts only.
  • Ensure that authentication mechanisms enforce least‑privileged access and that roles are limited to the minimal required.

Generated by OpenCVE AI on October 24, 2026 at 00:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 04 Nov 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Oracle siebel Crm
CPEs cpe:2.3:a:oracle:siebel_crm:*:*:*:*:*:*:*:*
Vendors & Products Oracle siebel Crm

Sat, 24 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Title Low‑privileged HTTP Attack Enables Full Takeover of Oracle Siebel CRM Deployment

Fri, 23 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Title Low‑Privilege HTTP Exploit Enables Full Compromise of Oracle Siebel CRM Deployment
Weaknesses CWE-284

Fri, 23 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-306
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 10:15:00 +0000

Type Values Removed Values Added
Title Low‑Privilege HTTP Exploit Enables Full Compromise of Oracle Siebel CRM Deployment
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in takeover of Siebel CRM Deployment. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle siebel Crm Deployment
CPEs cpe:2.3:a:oracle:siebel_crm_deployment:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle siebel Crm Deployment
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Siebel Crm Siebel Crm Deployment
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-23T20:29:00.236Z

Reserved: 2026-09-14T22:10:16.635Z

Link: CVE-2026-91442

cve-icon Vulnrichment

Updated: 2026-10-23T20:28:55.353Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:47.790

Modified: 2026-11-04T15:06:00.780

Link: CVE-2026-91442

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-24T00:30:12Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function