{"id":"CVE-2026-91359","kind":"vulnerability","aliases":["CVE-2026-91359"],"related":[],"title":"Oracle Siebel CRM Cloud: unauthenticated read of some CRM data","description":"Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).  Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud Applications.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","summary":"Oracle Siebel CRM Cloud Applications, through the Siebel Cloud Manager component, contains a flaw reachable over HTTP. An unauthenticated attacker with network access can read a subset of the data the application holds.","severity":"medium","cvss":5.3,"epss":0.00316,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cloud","oracle","siebel-crm","vendor"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-20T22:20:38+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T04:22:48+00:00","updated_at":"2026-10-25T12:38:52+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T04:22:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Oracle Siebel CRM Cloud: unauthenticated read of some CRM data","impact":"low","summary":"Oracle Siebel CRM Cloud Applications, through the Siebel Cloud Manager component, contains a flaw reachable over HTTP. An unauthenticated attacker with network access can read a subset of the data the application holds.","category":"vendor","nicknames":[],"who_cares":["siebel-crm","oracle","cloud"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated read access to a subset of CRM data","analyst_note":"Confirm the affected version range, whether a patch or vendor action is required, and whether Oracle-managed cloud instances need customer action; check the Oracle Critical Patch Update advisory.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running Oracle Siebel CRM Cloud Applications in the affected supported version range 22.3 to 26.9, which the sources list as affected. The sources do not say which deployment configurations are exposed, so check the affected version range against your Oracle-hosted or managed Siebel environment.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00058,"input_tokens":3483,"output_tokens":463,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-26.9':79C '-91359':13A,16A '/av':129C '22.3':78C '3.1':119C,128C '5.3':122C 'access':45B,88C,107C,116C 'affect':76C 'allow':83C 'applic':27B,54B,62C,96C,115C 'attack':42B,85C,98C 'base':120C 'cloud':4A,17B,26B,31B,61C,70C,95C,114C 'compon':33B,68C 'compromis':92C 'confidenti':123C 'contain':34B 'crm':3A,9A,21B,25B,60C,67C,94C,113C 'cve':11A,14A 'cvss':118C,125C,127C 'data':10A,52B,117C 'easili':80C 'exploit':81C 'flaw':36B 'hold':55B 'http':39B,90C 'impact':124C 'l/i':135C 'l/pr':131C 'manag':32B,71C 'n':137C 'n/a':136C 'n/ac':130C 'n/s':133C 'n/ui':132C 'network':44B,87C 'oracl':1A,18B,23B,65C 'product':63C 'reachabl':37B 'read':6A,47B,106C 'result':103C 'score':121C 'siebel':2A,20B,24B,30B,59C,66C,69C,93C,112C 'siebel-crm':19B 'subset':49B,110C 'success':97C 'support':72C 'u/c':134C 'unauthent':5A,41B,84C 'unauthor':105C 'vector':126C 'vendor':22B 'version':73C 'via':89C 'vulner':56C,82C,101C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle Siebel CRM Cloud Applications in the affected supported version range 22.3 to 26.9, which the sources list as affected. The sources do not say which deployment configurations are exposed, so check the affected version range against your Oracle-hosted or managed Siebel environment.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91359","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91359","severity":null,"published_at":"2026-10-20T22:20:38+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91359","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91359","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:52+00:00","fetched_at":"2026-10-25T12:38:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}