{"id":"CVE-2026-91362","kind":"vulnerability","aliases":["CVE-2026-91362"],"related":[],"title":"Oracle Siebel CRM Cloud: unauthenticated HTTP request reads a subset of data","description":"Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).  Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud Applications.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","summary":"Siebel CRM Cloud Applications, in the Siebel Cloud Manager component, is affected in versions 22.3 through 26.9. An unauthenticated attacker with network access over HTTP can read a subset of the data the application holds.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["oracle-cloud","siebel-crm","vendor"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-20T22:20:39+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T04:22:43+00:00","updated_at":"2026-10-25T04:22:43+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-10-25T04:22:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Oracle Siebel CRM Cloud: unauthenticated HTTP request reads a subset of data","impact":"low","summary":"Siebel CRM Cloud Applications, in the Siebel Cloud Manager component, is affected in versions 22.3 through 26.9. An unauthenticated attacker with network access over HTTP can read a subset of the data the application holds.","category":"vendor","nicknames":[],"who_cares":["siebel-crm","oracle-cloud"],"confidence":0.5,"needs_auth":"no","worst_case":"Unauthenticated read access to a subset of CRM data","analyst_note":"Check Oracle's Critical Patch Update advisory for the fixed Siebel Cloud Manager versions and the exact affected deployments.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000528,"input_tokens":3483,"output_tokens":359,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-26.9':84C '-91362':15A,18A '/av':134C '22.3':40B,83C '26.9':42B '3.1':124C,133C '5.3':127C 'access':48B,93C,112C,121C 'affect':37B,81C 'allow':88C 'applic':29B,59B,67C,101C,120C 'attack':45B,90C,103C 'base':125C 'cloud':4A,21B,28B,33B,66C,75C,100C,119C 'compon':35B,73C 'compromis':97C 'confidenti':128C 'crm':3A,24B,27B,65C,72C,99C,118C 'cve':13A,16A 'cvss':123C,130C,132C 'data':12A,57B,122C 'easili':85C 'exploit':86C 'hold':60B 'http':6A,50B,95C 'impact':129C 'l/i':140C 'l/pr':136C 'manag':34B,76C 'n':142C 'n/a':141C 'n/ac':135C 'n/s':138C 'n/ui':137C 'network':47B,92C 'oracl':1A,20B,70C 'oracle-cloud':19B 'product':68C 'read':8A,52B,111C 'request':7A 'result':108C 'score':126C 'siebel':2A,23B,26B,32B,64C,71C,74C,98C,117C 'siebel-crm':22B 'subset':10A,54B,115C 'success':102C 'support':77C 'u/c':139C 'unauthent':5A,44B,89C 'unauthor':110C 'vector':131C 'vendor':25B 'version':39B,78C 'via':94C 'vulner':61C,87C,106C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:39+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91362","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91362","severity":null,"published_at":"2026-10-20T22:20:39+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}