Live › vulnerability › CVE-2026-91433
Go to dashboardOracle Siebel CRM's Field Service product has a flaw in its Smart Answer component that a high-privileged user can reach over HTTP. Successful exploitation can give the attacker full control of the Siebel Apps Field Service application, per NVD's CVSS 7.2 score.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Organisations running Oracle Siebel CRM Field Service in the affected version range 17.0-26.9, reachable over HTTP by users who hold high privileges. The sources do not say whether Smart Answer must be enabled to be exposed, so treat it as in scope if the component is deployed. Teams not running Siebel Field Service can skip it.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the Siebel Apps - Field Service product of Oracle Siebel CRM (component: Smart Answer). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Siebel Apps - Field Service. Successful attacks of this vulnerability can result in takeover of Siebel Apps - Field Service. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
This page as .md · .json · in your agent: get_signal("CVE-2026-91433")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.