{"id":"CVE-2026-91427","kind":"vulnerability","aliases":["CVE-2026-91427"],"related":[],"title":"Oracle Siebel CRM Deployment: high-privilege user can partially disrupt service","description":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Siebel CRM Deployment. CVSS 3.1 Base Score 2.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L).","summary":"Oracle Siebel CRM Deployment, in the Server Infrastructure component, has a flaw that lets a highly privileged local user partially disrupt the service. The sources describe only a partial denial of service with no confidentiality or integrity impact.","severity":"low","cvss":2.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["oracle","self-hosted","siebel-crm","vendor"],"not_affected_if":["no-siebel-deployment"],"how_to_check":"- Check whether the Siebel CRM Deployment product is installed and which version it runs: unknown\n- Confirm whether the installed version falls in 17.0 to 26.9: unknown","fix":"- Apply the Oracle Siebel CRM patch referenced in the Oracle Critical Patch Update for the affected release: unknown","status":"open","published_at":"2026-10-20T22:20:46+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T04:49:47+00:00","updated_at":"2026-10-25T04:49:47+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T04:49:47Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Siebel CRM patch referenced in the Oracle Critical Patch Update for the affected release: unknown","reach":"local","title":"Oracle Siebel CRM Deployment: high-privilege user can partially disrupt service","impact":"low","summary":"Oracle Siebel CRM Deployment, in the Server Infrastructure component, has a flaw that lets a highly privileged local user partially disrupt the service. The sources describe only a partial denial of service with no confidentiality or integrity impact.","category":"vendor","nicknames":[],"who_cares":["siebel-crm","oracle","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"partial denial of service against Siebel CRM Deployment","analyst_note":"Check the Oracle Critical Patch Update advisory for the exact fixed Siebel CRM Deployment release and patch number for 17.0 to 26.9.","how_to_check":"- Check whether the Siebel CRM Deployment product is installed and which version it runs: unknown\n- Confirm whether the installed version falls in 17.0 to 26.9: unknown","needs_analyst":true,"not_affected_if":["no-siebel-deployment"],"who_is_affected":"Deployments of Oracle Siebel CRM Deployment in the affected version range are listed as affected. Exploitation needs a high-privilege account with logon to the host where the product runs, so the exposure is limited to internal administrators; the sources do not say which exact versions or patch levels are impacted beyond the 17.0-26.9 range.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000638,"input_tokens":3483,"output_tokens":580,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-26.9':86C '-91427':15A,18A '/av':143C '17.0':85C '2.3':136C '3.1':133C,142C 'abil':118C 'affect':83C 'allow':90C 'attack':93C,110C 'avail':137C 'base':134C 'caus':120C 'compon':35B,76C 'compromis':105C 'confidenti':61B 'crm':3A,25B,29B,69C,75C,101C,107C,130C 'cve':13A,16A 'cvss':132C,139C,141C 'denial':56B,123C 'deploy':4A,30B,70C,102C,108C,131C 'describ':52B 'disrupt':11A,47B 'dos':127C 'easili':87C 'execut':103C 'exploit':88C 'flaw':38B 'h/ui':146C 'high':6A,42B,91C 'high-privileg':5A 'host':22B 'impact':64B,138C 'infrastructur':34B,78C,98C 'integr':63B 'l':151C 'l/ac':144C 'l/pr':145C 'let':40B 'local':44B 'logon':95C 'n/a':150C 'n/i':149C 'n/s':147C 'oracl':1A,19B,27B,73C 'partial':10A,46B,55B,122C,126C 'privileg':7A,43B,92C 'product':71C 'result':115C 'score':135C 'self':21B 'self-host':20B 'server':33B,77C 'servic':12A,49B,58B,125C 'siebel':2A,24B,28B,68C,74C,100C,106C,129C 'siebel-crm':23B 'sourc':51B 'success':109C 'support':79C 'u/c':148C 'unauthor':117C 'user':8A,45B 'vector':140C 'vendor':26B 'version':80C 'vulner':65C,89C,113C","nicknames":[],"mitigations":[],"who_affected":"Deployments of Oracle Siebel CRM Deployment in the affected version range are listed as affected. Exploitation needs a high-privilege account with logon to the host where the product runs, so the exposure is limited to internal administrators; the sources do not say which exact versions or patch levels are impacted beyond the 17.0-26.9 range.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91427","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91427","severity":null,"published_at":"2026-10-20T22:20:46+00:00","modified_at":"2026-10-23T21:17:26+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}