{"id":"CVE-2026-91435","kind":"vulnerability","aliases":["CVE-2026-91435"],"related":[],"title":"Oracle Siebel CRM: low-privileged HTTP request can crash the server","description":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel CRM Deployment. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).","summary":"Oracle Siebel CRM Deployment's Server Infrastructure component has a flaw that lets a low-privileged user over HTTP cause a hang or repeatable crash of the service. The sources describe a denial of service only, with no code execution or data exposure.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise-crm","oracle","self-hosted","siebel-crm","vendor"],"not_affected_if":["http-not-exposed","no-siebel-deployment"],"how_to_check":"- Confirm the Siebel CRM Deployment version in use; the sources list supported versions 17.0 through 26.9 as affected.\n- Check the Oracle Critical Patch Update advisory for the patch level covering this CVE; the sources do not name the fixed build.","fix":"- Apply the Oracle Siebel CRM security patch for CVE-2026-91435 from the Oracle Critical Patch Update; the fixed version is unknown from the sources.\n- Restrict HTTP access to Siebel server endpoints to trusted networks until patched.","status":"open","published_at":"2026-10-20T22:20:46+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T03:49:30+00:00","updated_at":"2026-10-25T03:49:30+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:49:30Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Siebel CRM security patch for CVE-2026-91435 from the Oracle Critical Patch Update; the fixed version is unknown from the sources.\n- Restrict HTTP access to Siebel server endpoints to trusted networks until patched.","reach":"network","title":"Oracle Siebel CRM: low-privileged HTTP request can crash the server","impact":"low","summary":"Oracle Siebel CRM Deployment's Server Infrastructure component has a flaw that lets a low-privileged user over HTTP cause a hang or repeatable crash of the service. The sources describe a denial of service only, with no code execution or data exposure.","category":"vendor","nicknames":[],"who_cares":["siebel-crm","oracle","enterprise-crm","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Siebel service hangs or crashes repeatedly, causing denial of service","analyst_note":"Find Oracle's CPU advisory for CVE-2026-91435 to confirm the fixed Siebel version and any workaround.","how_to_check":"- Confirm the Siebel CRM Deployment version in use; the sources list supported versions 17.0 through 26.9 as affected.\n- Check the Oracle Critical Patch Update advisory for the patch level covering this CVE; the sources do not name the fixed build.","needs_analyst":true,"not_affected_if":["no-siebel-deployment","http-not-exposed"],"who_is_affected":"Organisations running Oracle Siebel CRM Deployment in the affected version range 17.0 to 26.9 with HTTP reachable from a network where low-privileged users can connect. Systems not running Siebel CRM, or where the Siebel web tier is not exposed to untrusted users, are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000677,"input_tokens":3474,"output_tokens":660,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-26.9':95C '-91435':15A,18A '/av':148C '17.0':94C '3.1':138C,147C '6.5':141C 'abil':122C 'access':105C 'affect':92C 'allow':99C 'attack':102C,114C 'avail':142C 'base':139C 'caus':50B,124C 'code':69B 'complet':131C 'compon':37B,85C 'compromis':109C 'crash':10A,55B,130C 'crm':3A,21B,28B,32B,78C,84C,111C,135C 'cve':13A,16A 'cvss':137C,144C,146C 'data':72B 'denial':63B 'deploy':33B,79C,112C,136C 'describ':61B 'dos':132C 'easili':96C 'enterpris':20B 'enterprise-crm':19B 'execut':70B 'exploit':97C 'exposur':73B 'flaw':40B 'frequent':128C 'h':156C 'hang':52B,126C 'host':25B 'http':7A,49B,107C 'impact':143C 'infrastructur':36B,87C 'l/pr':150C 'l/ui':151C 'let':42B 'low':5A,45B,100C 'low-privileg':4A,44B 'n/a':155C 'n/ac':149C 'n/i':154C 'n/s':152C 'network':104C 'oracl':1A,22B,30B,82C 'privileg':6A,46B,101C 'product':80C 'repeat':54B,129C 'request':8A 'result':119C 'score':140C 'self':24B 'self-host':23B 'server':12A,35B,86C 'servic':58B,65B 'siebel':2A,27B,31B,77C,83C,110C,134C 'siebel-crm':26B 'sourc':60B 'success':113C 'support':88C 'u/c':153C 'unauthor':121C 'user':47B 'vector':145C 'vendor':29B 'version':89C 'via':106C 'vulner':74C,98C,117C","nicknames":[],"mitigations":[],"who_affected":"Organisations running Oracle Siebel CRM Deployment in the affected version range 17.0 to 26.9 with HTTP reachable from a network where low-privileged users can connect. Systems not running Siebel CRM, or where the Siebel web tier is not exposed to untrusted users, are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91435","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91435","severity":null,"published_at":"2026-10-20T22:20:46+00:00","modified_at":"2026-10-23T21:17:27+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}