Description
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in takeover of Siebel CRM Deployment. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 6.7 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Compromise of Siebel CRM Deployment
Action: Patch Immediately
AI Analysis

Impact

The flaw in Oracle’s Siebel CRM Deployment Server Infrastructure allows an attacker who already has privileged access to the infrastructure to take full control of the deployment. It grants attackers the ability to read, modify, and delete data, as well as disrupt services, thereby compromising confidentiality, integrity, and availability. The vulnerability corresponds to an Improper Privilege Management weakness (CWE-269).

Affected Systems

Oracle Corporation’s Siebel CRM Deployment, versions 17.0 through 26.9.

Risk and Exploitability

With a CVSS score of 6.7, the vulnerability presents moderate severity, requiring local access and high privilege to exploit. It is not listed in CISA’s KEV catalog and the EPSS score is < 1%, indicating a very low likelihood of exploitation. Nevertheless, because the impact is complete takeover of the deployment, the risk remains high for any organization that has privileged users on the host system.

Generated by OpenCVE AI on October 24, 2026 at 01:24 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the official Oracle patch or upgrade to a version outside the 17.0–26.9 range once it becomes available.
  • Restrict the number of accounts with high‑privilege access and enforce least‑privilege policies for the Siebel environment.
  • Enable and actively review detailed logging and monitoring for privileged account activity to detect potential misuse early.

Generated by OpenCVE AI on October 24, 2026 at 01:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 04 Nov 2026 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Oracle siebel Crm
CPEs cpe:2.3:a:oracle:siebel_crm:*:*:*:*:*:*:*:*
Vendors & Products Oracle siebel Crm

Sat, 24 Oct 2026 01:45:00 +0000

Type Values Removed Values Added
Title High-Privilege Local Exploit Allowing Full Takeover of Siebel CRM Deployment

Sat, 24 Oct 2026 00:00:00 +0000

Type Values Removed Values Added
Title High Privilege Exploit Compromises Siebel CRM Deployment
Weaknesses CWE-284

Fri, 23 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 10:15:00 +0000

Type Values Removed Values Added
Title High Privilege Exploit Compromises Siebel CRM Deployment
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in takeover of Siebel CRM Deployment. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle siebel Crm Deployment
CPEs cpe:2.3:a:oracle:siebel_crm_deployment:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle siebel Crm Deployment
References
Metrics cvssV3_1

{'score': 6.7, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Siebel Crm Siebel Crm Deployment
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-23T20:31:00.900Z

Reserved: 2026-09-14T22:10:16.635Z

Link: CVE-2026-91444

cve-icon Vulnrichment

Updated: 2026-10-23T20:30:55.319Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:48.020

Modified: 2026-11-04T14:22:12.327

Link: CVE-2026-91444

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-24T01:30:18Z

Weaknesses
  • CWE-269

    Improper Privilege Management