{"id":"CVE-2026-91430","kind":"vulnerability","aliases":["CVE-2026-91430"],"related":[],"title":"Oracle Siebel Financial Services: unauthenticated HTTP flaw exposes and alters CRM data","description":"Vulnerability in the Siebel Apps - Financial Services product of Oracle Siebel CRM (component: Financial Accounts).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Financial Services.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel Apps - Financial Services accessible data as well as  unauthorized update, insert or delete access to some of Siebel Apps - Financial Services accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N).","summary":"Oracle Siebel Apps - Financial Services, in the Financial Accounts component, has a flaw that lets an unauthenticated attacker reach it over the network via HTTP. A successful attack can read critical data, often all data the app can access, and make some limited updates, inserts or deletes.","severity":"medium","cvss":6.5,"epss":0.00217,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["crm","financial-services","oracle","siebel","vendor"],"not_affected_if":["not-in-affected-version-range","not-siebel-financial-services"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-20T22:20:46+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T03:49:32+00:00","updated_at":"2026-10-25T12:38:52+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:49:32Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle Siebel Financial Services: unauthenticated HTTP flaw exposes and alters CRM data","impact":"high","summary":"Oracle Siebel Apps - Financial Services, in the Financial Accounts component, has a flaw that lets an unauthenticated attacker reach it over the network via HTTP. A successful attack can read critical data, often all data the app can access, and make some limited updates, inserts or deletes.","category":"vendor","nicknames":[],"who_cares":["siebel","oracle","crm","financial-services"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads critical CRM financial data and modifies some records","analyst_note":"Check Oracle's Critical Patch Update advisory for the patched Siebel Financial Services release and the exact affected build list; the NVD entry gives only the 17.0-26.9 range.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["not-siebel-financial-services","not-in-affected-version-range"],"who_is_affected":"Deployments of Oracle Siebel Apps - Financial Services in the affected version range 17.0-26.9 that are reachable over HTTP from the network. Exploitation is rated difficult (high attack complexity), so it is not trivial, but no login is required. Teams not running Siebel Financial Services can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000611,"input_tokens":3518,"output_tokens":519,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-26.9':95C '-91430':15A,18A '/av':169C '17.0':94C '3.1':157C,168C '6.5':160C 'access':64B,105C,123C,129C,136C,146C,154C 'account':34B,87C 'affect':92C 'allow':100C 'alter':10A 'app':28B,62B,77C,111C,133C,151C 'attack':43B,53B,102C,115C 'base':158C 'complet':128C 'compon':35B,85C 'compromis':109C 'confidenti':161C 'critic':56B,125C 'crm':11A,19B,84C 'cve':13A,16A 'cvss':156C,165C,167C 'data':12A,57B,60B,126C,137C,155C 'delet':72B,145C 'difficult':96C 'exploit':98C 'expos':8A 'financi':3A,21B,29B,33B,78C,86C,112C,134C,152C 'financial-servic':20B 'flaw':7A,38B 'h/i':175C 'h/pr':171C 'http':6A,50B,107C 'impact':164C 'insert':70B,143C 'integr':163C 'l/a':176C 'let':40B 'limit':68B 'make':66B 'n':177C 'n/ac':170C 'n/s':173C 'n/ui':172C 'network':48B,104C 'often':58B 'oracl':1A,23B,26B,82C 'product':80C 'reach':44B 'read':55B 'result':120C 'score':159C 'servic':4A,22B,30B,79C,113C,135C,153C 'siebel':2A,24B,27B,76C,83C,110C,132C,150C 'success':52B,114C 'support':88C 'u/c':174C 'unauthent':5A,42B,101C 'unauthor':122C,141C 'updat':69B,142C 'vector':166C 'vendor':25B 'version':89C 'via':49B,106C 'vulner':73C,99C,118C 'well':139C","nicknames":[],"mitigations":[],"who_affected":"Deployments of Oracle Siebel Apps - Financial Services in the affected version range 17.0-26.9 that are reachable over HTTP from the network. Exploitation is rated difficult (high attack complexity), so it is not trivial, but no login is required. Teams not running Siebel Financial Services can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91430","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91430","severity":null,"published_at":"2026-10-20T22:20:46+00:00","modified_at":"2026-10-23T21:17:26+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91430","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91430","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:52+00:00","fetched_at":"2026-10-25T12:38:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}