{"id":"CVE-2026-91433","kind":"vulnerability","aliases":["CVE-2026-91433"],"related":[],"title":"Oracle Siebel Field Service: Smart Answer flaw enables takeover by privileged users","description":"Vulnerability in the Siebel Apps - Field Service product of Oracle Siebel CRM (component: Smart Answer).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Siebel Apps - Field Service.  Successful attacks of this vulnerability can result in takeover of Siebel Apps - Field Service. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Siebel CRM's Field Service product has a flaw in its Smart Answer component that a high-privileged user can reach over HTTP. Successful exploitation can give the attacker full control of the Siebel Apps Field Service application, per NVD's CVSS 7.2 score.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise-crm","field-service","oracle","siebel","vendor"],"not_affected_if":["not-siebel-field-service"],"how_to_check":"- Confirm whether Siebel Apps Field Service is deployed and which version runs, against the affected range 17.0-26.9 in the Oracle advisory\n- Check whether the Smart Answer component is enabled in your deployment\n- unknown for any further check: the sources do not give a file, setting or command","fix":"- Apply the Oracle Siebel CRM Field Service patch for CVE-2026-91433 (fixed version: unknown in the sources)\n- Consult the Oracle Critical Patch Update advisory for the exact patch set","status":"open","published_at":"2026-10-20T22:20:46+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T03:29:05+00:00","updated_at":"2026-10-25T03:29:05+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:29:05Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Siebel CRM Field Service patch for CVE-2026-91433 (fixed version: unknown in the sources)\n- Consult the Oracle Critical Patch Update advisory for the exact patch set","reach":"network","title":"Oracle Siebel Field Service: Smart Answer flaw enables takeover by privileged users","impact":"high","summary":"Oracle Siebel CRM's Field Service product has a flaw in its Smart Answer component that a high-privileged user can reach over HTTP. Successful exploitation can give the attacker full control of the Siebel Apps Field Service application, per NVD's CVSS 7.2 score.","category":"vendor","nicknames":[],"who_cares":["siebel","oracle","field-service","enterprise-crm"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker with high privileges takes over the Field Service application","analyst_note":"Find the Oracle Siebel CRM security alert for CVE-2026-91433 to get the patched version and any configuration details for Smart Answer.","how_to_check":"- Confirm whether Siebel Apps Field Service is deployed and which version runs, against the affected range 17.0-26.9 in the Oracle advisory\n- Check whether the Smart Answer component is enabled in your deployment\n- unknown for any further check: the sources do not give a file, setting or command","needs_analyst":true,"not_affected_if":["not-siebel-field-service"],"who_is_affected":"Organisations running Oracle Siebel CRM Field Service in the affected version range 17.0-26.9, reachable over HTTP by users who hold high privileges. The sources do not say whether Smart Answer must be enabled to be exposed, so treat it as in scope if the component is deployed. Teams not running Siebel Field Service can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000679,"input_tokens":3458,"output_tokens":667,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-26.9':96C '-91433':15A,18A '/av':143C '17.0':95C '3.1':130C,142C '7.2':72B,133C 'access':106C 'affect':93C 'allow':100C 'answer':6A,41B,88C 'app':64B,78C,112C,126C 'applic':67B 'attack':58B,103C,116C 'avail':137C 'base':131C 'compon':42B,86C 'compromis':110C 'confidenti':134C 'control':60B 'crm':21B,30B,85C 'cve':13A,16A 'cvss':71B,129C,139C,141C 'easili':97C 'enabl':8A 'enterpris':20B 'enterprise-crm':19B 'exploit':54B,98C 'field':3A,23B,32B,65B,79C,113C,127C 'field-servic':22B 'flaw':7A,37B 'full':59B 'give':56B 'h':151C 'h/a':150C 'h/i':149C 'h/ui':146C 'high':46B,101C 'high-privileg':45B 'http':52B,108C 'impact':138C 'integr':135C 'l/pr':145C 'n/ac':144C 'n/s':147C 'network':105C 'nvd':69B 'oracl':1A,25B,28B,83C 'per':68B 'privileg':11A,47B,102C 'product':34B,81C 'reach':50B 'result':121C 'score':73B,132C 'servic':4A,24B,33B,66B,80C,114C,128C 'siebel':2A,26B,29B,63B,77C,84C,111C,125C 'smart':5A,40B,87C 'success':53B,115C 'support':89C 'takeov':9A,123C 'u/c':148C 'user':12A,48B 'vector':140C 'vendor':27B 'version':90C 'via':107C 'vulner':74C,99C,119C","nicknames":[],"mitigations":[],"who_affected":"Organisations running Oracle Siebel CRM Field Service in the affected version range 17.0-26.9, reachable over HTTP by users who hold high privileges. The sources do not say whether Smart Answer must be enabled to be exposed, so treat it as in scope if the component is deployed. Teams not running Siebel Field Service can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91433","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91433","severity":null,"published_at":"2026-10-20T22:20:46+00:00","modified_at":"2026-10-23T21:17:27+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}