{"id":"CVE-2026-91434","kind":"vulnerability","aliases":["CVE-2026-91434"],"related":[],"title":"Oracle Siebel CRM Deployment: local high-privilege user can take over server","description":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in takeover of Siebel CRM Deployment. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Siebel CRM Deployment, in the Server Infrastructure component, has a flaw affecting supported versions 17.0 through 26.9. A user with high privileges and logon to the host where Siebel CRM Deployment runs can fully compromise the product.","severity":"medium","cvss":6.7,"epss":0.00117,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise","oracle","siebel-crm","vendor"],"not_affected_if":["not-siebel-crm","versions-outside-17.0-26.9"],"how_to_check":"- Confirm whether Siebel CRM Deployment is installed and which version runs, as listed in Oracle's advisory.\n- unknown: the sources do not give a file, command or setting to check further.","fix":"- Apply the Oracle Critical Patch Update for Siebel CRM that covers the Server Infrastructure component; the target version is unknown from these sources.","status":"open","published_at":"2026-10-20T22:20:46+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T03:46:34+00:00","updated_at":"2026-10-25T12:38:52+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:46:34Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update for Siebel CRM that covers the Server Infrastructure component; the target version is unknown from these sources.","reach":"local","title":"Oracle Siebel CRM Deployment: local high-privilege user can take over server","impact":"high","summary":"Oracle Siebel CRM Deployment, in the Server Infrastructure component, has a flaw affecting supported versions 17.0 through 26.9. A user with high privileges and logon to the host where Siebel CRM Deployment runs can fully compromise the product.","category":"vendor","nicknames":[],"who_cares":["oracle","siebel-crm","enterprise"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker takes over Siebel CRM Deployment, reading and changing its data","analyst_note":"","how_to_check":"- Confirm whether Siebel CRM Deployment is installed and which version runs, as listed in Oracle's advisory.\n- unknown: the sources do not give a file, command or setting to check further.","needs_analyst":false,"not_affected_if":["not-siebel-crm","versions-outside-17.0-26.9"],"who_is_affected":"Organizations running Oracle Siebel CRM Deployment in the affected version range 17.0 through 26.9. Exposure requires an attacker who already has high privileges and logon on the infrastructure where the product executes, so the risk is mainly insider or post-compromise. Teams not running Siebel CRM can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000626,"input_tokens":3475,"output_tokens":557,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-26.9':85C '-91434':16A,19A '/av':135C '17.0':41B,84C '26.9':43B '3.1':122C,134C '6.7':125C 'affect':38B,82C 'allow':89C 'attack':92C,109C 'avail':129C 'base':123C 'compon':34B,75C 'compromis':61B,104C 'confidenti':126C 'crm':3A,24B,28B,56B,68C,74C,100C,106C,119C 'cve':14A,17A 'cvss':121C,131C,133C 'deploy':4A,29B,57B,69C,101C,107C,120C 'easili':86C 'enterpris':20B 'execut':102C 'exploit':87C 'flaw':37B 'fulli':60B 'h':143C 'h/a':142C 'h/i':141C 'h/ui':138C 'high':7A,47B,90C 'high-privileg':6A 'host':53B 'impact':130C 'infrastructur':33B,77C,97C 'integr':127C 'l/ac':136C 'l/pr':137C 'local':5A 'logon':50B,94C 'n/s':139C 'oracl':1A,21B,26B,72C 'privileg':8A,48B,91C 'product':63B,70C 'result':114C 'run':58B 'score':124C 'server':13A,32B,76C 'siebel':2A,23B,27B,55B,67C,73C,99C,105C,118C 'siebel-crm':22B 'success':108C 'support':39B,78C 'take':11A 'takeov':116C 'u/c':140C 'user':9A,45B 'vector':132C 'vendor':25B 'version':40B,79C 'vulner':64C,88C,112C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle Siebel CRM Deployment in the affected version range 17.0 through 26.9. Exposure requires an attacker who already has high privileges and logon on the infrastructure where the product executes, so the risk is mainly insider or post-compromise. Teams not running Siebel CRM can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91434","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91434","severity":null,"published_at":"2026-10-20T22:20:46+00:00","modified_at":"2026-10-23T21:17:27+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91434","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91434","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:52+00:00","fetched_at":"2026-10-25T12:38:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}