{"id":"CVE-2026-91424","kind":"vulnerability","aliases":["CVE-2026-91424"],"related":[],"title":"Oracle Siebel CRM Deployment: HTTP flaw allows data reads, edits and crashes","description":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel CRM Deployment as well as  unauthorized update, insert or delete access to some of Siebel CRM Deployment accessible data and  unauthorized read access to a subset of Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H).","summary":"Oracle Siebel CRM Deployment's Server Infrastructure component has a flaw reachable over HTTP by a low-privileged user. A successful attack can read and change a subset of accessible data and can hang or repeatedly crash the service.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise-crm","oracle","self-hosted","siebel-crm","vendor"],"not_affected_if":["unknown"],"how_to_check":"- Check the Siebel CRM Deployment version against the affected range 17.0 to 26.9 in the Oracle Siebel install or patch records\n- unknown for further checks","fix":"- Apply the Oracle Critical Patch Update for Siebel CRM that addresses CVE-2026-91424, as listed in Oracle's advisory\n- unknown for the exact fixed version","status":"open","published_at":"2026-10-20T22:20:45+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T03:59:25+00:00","updated_at":"2026-10-25T03:59:25+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:59:25Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update for Siebel CRM that addresses CVE-2026-91424, as listed in Oracle's advisory\n- unknown for the exact fixed version","reach":"network","title":"Oracle Siebel CRM Deployment: HTTP flaw allows data reads, edits and crashes","impact":"medium","summary":"Oracle Siebel CRM Deployment's Server Infrastructure component has a flaw reachable over HTTP by a low-privileged user. A successful attack can read and change a subset of accessible data and can hang or repeatedly crash the service.","category":"vendor","nicknames":[],"who_cares":["siebel-crm","oracle","self-hosted","enterprise-crm"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads and changes some CRM data or crashes the service","analyst_note":"Confirm the fixed Siebel CRM patch version and the Oracle CPU advisory link for CVE-2026-91424 at nvd.nist.gov or Oracle's security alerts page.","how_to_check":"- Check the Siebel CRM Deployment version against the affected range 17.0 to 26.9 in the Oracle Siebel install or patch records\n- unknown for further checks","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams running Oracle Siebel CRM Deployment in the 17.0 to 26.9 range with the Server Infrastructure component reachable over HTTP. The sources do not say which deployment settings expose the HTTP path, so exposure depends on whether users with low privileges can reach the server over the network.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000659,"input_tokens":3551,"output_tokens":607,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-26.9':91C '-91424':15A,18A '/av':178C '17.0':90C '3.1':165C,177C '6.4':168C 'abil':119C 'access':60B,102C,142C,149C,154C,162C 'affect':88C 'allow':7A,96C 'attack':52B,99C,111C 'avail':172C 'base':166C 'caus':121C 'chang':56B 'complet':128C 'compon':37B,81C 'compromis':106C 'confidenti':169C 'crash':12A,67B,127C 'crm':3A,21B,28B,32B,74C,80C,108C,132C,147C,160C 'cve':13A,16A 'cvss':164C,174C,176C 'data':8A,61B,150C,163C 'delet':141C 'deploy':4A,33B,75C,109C,133C,148C,161C 'difficult':92C 'dos':129C 'edit':10A 'enterpris':20B 'enterprise-crm':19B 'exploit':94C 'flaw':6A,40B 'frequent':125C 'h':186C 'h/pr':180C 'hang':64B,123C 'host':25B 'http':5A,43B,104C 'impact':173C 'infrastructur':36B,83C 'insert':139C 'integr':170C 'l/a':185C 'l/i':184C 'l/ui':181C 'low':47B,97C 'low-privileg':46B 'n/ac':179C 'n/s':182C 'network':101C 'oracl':1A,22B,30B,78C 'privileg':48B,98C 'product':76C 'reachabl':41B 'read':9A,54B,153C 'repeat':66B,126C 'result':116C 'score':167C 'self':24B 'self-host':23B 'server':35B,82C 'servic':69B 'siebel':2A,27B,31B,73C,79C,107C,131C,146C,159C 'siebel-crm':26B 'subset':58B,157C 'success':51B,110C 'support':84C 'u/c':183C 'unauthor':118C,137C,152C 'updat':138C 'user':49B 'vector':175C 'vendor':29B 'version':85C 'via':103C 'vulner':70C,95C,114C 'well':135C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle Siebel CRM Deployment in the 17.0 to 26.9 range with the Server Infrastructure component reachable over HTTP. The sources do not say which deployment settings expose the HTTP path, so exposure depends on whether users with low privileges can reach the server over the network.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91424","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91424","severity":null,"published_at":"2026-10-20T22:20:45+00:00","modified_at":"2026-10-23T21:17:26+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}