---
id: "CVE-2026-91424"
kind: "vulnerability"
aliases: ["CVE-2026-91424"]
title: "Oracle Siebel CRM Deployment: HTTP flaw allows data reads, edits and crashes"
severity: "medium"
cvss: 6.4
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["enterprise-crm", "oracle", "self-hosted", "siebel-crm", "vendor"]
not_affected_if: ["unknown"]
published_at: "2026-10-20T22:20:45+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-25T03:59:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91424", "first_seen_at": "2026-10-23T21:57:26+00:00"}]
---

# Oracle Siebel CRM Deployment: HTTP flaw allows data reads, edits and crashes

Oracle Siebel CRM Deployment's Server Infrastructure component has a flaw reachable over HTTP by a low-privileged user. A successful attack can read and change a subset of accessible data and can hang or repeatedly crash the service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Siebel CRM Deployment version against the affected range 17.0 to 26.9 in the Oracle Siebel install or patch records
- unknown for further checks

## Fix

- Apply the Oracle Critical Patch Update for Siebel CRM that addresses CVE-2026-91424, as listed in Oracle's advisory
- unknown for the exact fixed version

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91424

## From the sources

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel CRM Deployment as well as  unauthorized update, insert or delete access to some of Siebel CRM Deployment accessible data and  unauthorized read access to a subset of Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_