{"id":"CVE-2026-91372","kind":"vulnerability","aliases":["CVE-2026-91372"],"related":[],"title":"Oracle Siebel CRM Cloud: low-privilege read of some accessible data","description":"Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).  Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 3.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).","summary":"A flaw in Siebel Cloud Manager in Oracle Siebel CRM Cloud Applications lets an attacker who already has logon to the infrastructure read a subset of the application's data. The sources rate it CVSS 3.3 (low) with a local attack vector and confidentiality impact only.","severity":"low","cvss":3.3,"epss":0.00137,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise","oracle","other","siebel-crm"],"not_affected_if":["no-local-logon","unsupported-version"],"how_to_check":"- unknown","fix":"- Move to a Siebel CRM Cloud Applications release outside the affected 22.3-26.9 range, per Oracle's advisory (exact patched version unknown from the sources)","status":"open","published_at":"2026-10-20T22:20:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T04:45:59+00:00","updated_at":"2026-10-25T12:38:52+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T04:45:59Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a Siebel CRM Cloud Applications release outside the affected 22.3-26.9 range, per Oracle's advisory (exact patched version unknown from the sources)","reach":"local","title":"Oracle Siebel CRM Cloud: low-privilege read of some accessible data","impact":"low","summary":"A flaw in Siebel Cloud Manager in Oracle Siebel CRM Cloud Applications lets an attacker who already has logon to the infrastructure read a subset of the application's data. The sources rate it CVSS 3.3 (low) with a local attack vector and confidentiality impact only.","category":"other","nicknames":[],"who_cares":["siebel-crm","oracle","enterprise"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker with local logon reads a subset of CRM data","analyst_note":"Check Oracle Critical Patch Update advisory for CVE-2026-91372 for the patched version and whether the hosted service is already patched.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["unsupported-version","no-local-logon"],"who_is_affected":"Affected versions are Siebel CRM Cloud Applications 22.3 through 26.9. The attacker needs low-privilege logon to the infrastructure where the application runs, so exposure is mainly for Oracle-managed or self-hosted Siebel Cloud deployments with shared or untrusted internal access. Teams using only the hosted Oracle service not on these versions can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000632,"input_tokens":3499,"output_tokens":565,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-26.9':93C '-91372':15A,18A '/av':150C '22.3':92C '3.1':140C,149C '3.3':60B,143C 'access':11A,128C,137C 'affect':90C 'allow':97C 'alreadi':41B 'applic':36B,52B,76C,110C,117C,136C 'attack':39B,65B,100C,119C 'base':141C 'cloud':4A,29B,35B,75C,84C,109C,116C,135C 'compon':82C 'compromis':113C 'confidenti':68B,144C 'crm':3A,24B,34B,74C,81C,108C,115C,134C 'cve':13A,16A 'cvss':59B,139C,146C,148C 'data':12A,54B,138C 'easili':94C 'enterpris':19B 'execut':111C 'exploit':95C 'flaw':26B 'impact':69B,145C 'infrastructur':46B,105C 'l/ac':151C 'l/i':156C 'l/pr':152C 'l/ui':153C 'let':37B 'local':64B 'logon':43B,102C 'low':6A,61B,98C 'low-privileg':5A 'manag':30B,85C 'n':158C 'n/a':157C 'n/s':154C 'oracl':1A,20B,32B,79C 'privileg':7A,99C 'product':77C 'rate':57B 'read':8A,47B,127C 'result':124C 'score':142C 'siebel':2A,23B,28B,33B,73C,80C,83C,107C,114C,133C 'siebel-crm':22B 'sourc':56B 'subset':49B,131C 'success':118C 'support':86C 'u/c':155C 'unauthor':126C 'vector':66B,147C 'version':87C 'vulner':70C,96C,122C","nicknames":[],"mitigations":[],"who_affected":"Affected versions are Siebel CRM Cloud Applications 22.3 through 26.9. The attacker needs low-privilege logon to the infrastructure where the application runs, so exposure is mainly for Oracle-managed or self-hosted Siebel Cloud deployments with shared or untrusted internal access. Teams using only the hosted Oracle service not on these versions can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91372","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91372","severity":null,"published_at":"2026-10-20T22:20:40+00:00","modified_at":"2026-10-21T18:45:11+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91372","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91372","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:52+00:00","fetched_at":"2026-10-25T12:38:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}