{"id":"CVE-2026-91393","kind":"vulnerability","aliases":["CVE-2026-91393"],"related":[],"title":"Oracle Siebel CRM End User: Open UI flaw allows limited data changes","description":"Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel CRM End User accessible data. CVSS 3.1 Base Score 3.1 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).","summary":"Oracle Siebel CRM End User, versions 17.0 through 26.9, has a flaw in its Open UI component. An unauthenticated attacker on the network can, with a victim's help, make unauthorized updates, inserts or deletes to some data the end user can access.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise-crm","oracle","siebel-crm","vendor"],"not_affected_if":["no-network-exposure","unsupported-version-outside-range"],"how_to_check":"- Confirm whether Siebel CRM End User is deployed and which release runs, using the version shown in the Siebel installation or Oracle's release notes.\n- Check whether the Open UI component is in use.","fix":"- Move to a Siebel CRM release fixed by Oracle's Critical Patch Update (the fixed version is unknown from the sources).\n- Apply the Oracle Critical Patch Update for the affected release.","status":"open","published_at":"2026-10-20T22:20:42+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T04:47:31+00:00","updated_at":"2026-10-25T04:47:31+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-25T04:47:31Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a Siebel CRM release fixed by Oracle's Critical Patch Update (the fixed version is unknown from the sources).\n- Apply the Oracle Critical Patch Update for the affected release.","reach":"network","title":"Oracle Siebel CRM End User: Open UI flaw allows limited data changes","impact":"low","summary":"Oracle Siebel CRM End User, versions 17.0 through 26.9, has a flaw in its Open UI component. An unauthenticated attacker on the network can, with a victim's help, make unauthorized updates, inserts or deletes to some data the end user can access.","category":"vendor","nicknames":[],"who_cares":["siebel-crm","oracle","enterprise-crm"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker alters or deletes some CRM data accessible to users","analyst_note":"","how_to_check":"- Confirm whether Siebel CRM End User is deployed and which release runs, using the version shown in the Siebel installation or Oracle's release notes.\n- Check whether the Open UI component is in use.","needs_analyst":false,"not_affected_if":["unsupported-version-outside-range","no-network-exposure"],"who_is_affected":"Organizations running Oracle Siebel CRM End User in the affected range 17.0 through 26.9 with the Open UI component reachable over HTTP. Installations outside that version range, or without End User exposed to the network, are less likely to be affected. The sources do not say which configurations are most exposed.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000629,"input_tokens":3472,"output_tokens":563,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-26.9':92C '-91393':15A,18A '/av':157C '17.0':33B,91C '26.9':35B '3.1':147C,150C,156C 'access':69B,102C,136C,144C 'affect':89C 'allow':9A,97C 'attack':46B,99C,112C,122C,124C 'base':148C 'chang':12A 'compon':43B,82C 'compromis':106C 'crm':3A,21B,25B,29B,74C,81C,108C,141C 'cve':13A,16A 'cvss':146C,153C,155C 'data':11A,64B,145C 'delet':61B,135C 'difficult':93C 'end':4A,30B,66B,75C,109C,142C 'enterpris':20B 'enterprise-crm':19B 'exploit':95C 'flaw':8A,38B 'h/pr':159C 'help':55B 'http':104C 'human':114C 'impact':152C 'insert':59B,133C 'integr':151C 'interact':115C 'l/a':164C 'limit':10A 'make':56B 'n':165C 'n/ac':158C 'n/i':163C 'n/ui':160C 'network':49B,101C 'open':6A,41B,83C 'oracl':1A,22B,27B,79C 'person':118C 'product':77C 'r/s':161C 'requir':113C 'result':129C 'score':149C 'siebel':2A,24B,28B,73C,80C,107C,140C 'siebel-crm':23B 'success':111C,123C 'support':85C 'u/c':162C 'ui':7A,42B,84C 'unauthent':45B,98C 'unauthor':57B,131C 'updat':58B,132C 'user':5A,31B,67B,76C,110C,143C 'vector':154C 'vendor':26B 'version':32B,86C 'via':103C 'victim':53B 'vulner':70C,96C,127C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle Siebel CRM End User in the affected range 17.0 through 26.9 with the Open UI component reachable over HTTP. Installations outside that version range, or without End User exposed to the network, are less likely to be affected. The sources do not say which configurations are most exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91393","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91393","severity":null,"published_at":"2026-10-20T22:20:42+00:00","modified_at":"2026-10-21T18:45:11+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}