{"id":"CVE-2026-91436","kind":"vulnerability","aliases":["CVE-2026-91436"],"related":[],"title":"Oracle Siebel CRM Deployment: local high-privilege flaw exposes some data","description":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel CRM Deployment accessible data as well as  unauthorized read access to a subset of Siebel CRM Deployment accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Siebel CRM Deployment. CVSS 3.1 Base Score 3.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L).","summary":"Oracle Siebel CRM Deployment, in the Server Infrastructure component, has a flaw that lets a highly privileged local user with logon to the host partly read, change, or delete Siebel data and cause a partial denial of service. The attack is hard to carry out and needs high privileges, so the impact is limited.","severity":"low","cvss":3.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["on-prem","oracle","siebel-crm","vendor"],"not_affected_if":["not-siebel-deployment"],"how_to_check":"- Check whether any Siebel CRM Deployment version from `17.0` through `26.9` is installed; the sources do not give a command for this.","fix":"- Apply the Oracle Siebel CRM security patch for the affected release; the sources do not name the fixed version.","status":"open","published_at":"2026-10-20T22:20:47+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T04:42:03+00:00","updated_at":"2026-10-25T04:42:03+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T04:42:03Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Siebel CRM security patch for the affected release; the sources do not name the fixed version.","reach":"local","title":"Oracle Siebel CRM Deployment: local high-privilege flaw exposes some data","impact":"low","summary":"Oracle Siebel CRM Deployment, in the Server Infrastructure component, has a flaw that lets a highly privileged local user with logon to the host partly read, change, or delete Siebel data and cause a partial denial of service. The attack is hard to carry out and needs high privileges, so the impact is limited.","category":"vendor","nicknames":[],"who_cares":["siebel-crm","oracle","on-prem"],"confidence":0.6,"needs_auth":"yes","worst_case":"Partial data read, change, or delete, and partial service disruption","analyst_note":"Check Oracle's Critical Patch Update advisory for the fixed Siebel CRM Deployment version and the exact affected build list.","how_to_check":"- Check whether any Siebel CRM Deployment version from `17.0` through `26.9` is installed; the sources do not give a command for this.","needs_analyst":true,"not_affected_if":["not-siebel-deployment"],"who_is_affected":"Organizations running Oracle Siebel CRM Deployment in the affected release range, in particular where users with logon to the server host have high privileges. Systems that do not run Siebel CRM Deployment can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.00062,"input_tokens":3560,"output_tokens":528,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-26.9':102C '-91436':15A,18A '/av':193C '17.0':101C '3.1':180C,192C '3.9':183C 'abil':165C 'access':139C,146C,153C,161C 'affect':99C 'allow':107C 'attack':66B,110C,127C 'avail':187C 'base':181C 'carri':70B 'caus':59B,167C 'chang':53B 'compon':35B,92C 'compromis':122C 'confidenti':184C 'crm':3A,25B,29B,85C,91C,118C,124C,144C,159C,177C 'cve':13A,16A 'cvss':179C,189C,191C 'data':12A,57B,147C,162C 'delet':55B,138C 'denial':62B,170C 'deploy':4A,30B,86C,119C,125C,145C,160C,178C 'difficult':103C 'dos':174C 'execut':120C 'exploit':105C 'expos':10A 'flaw':9A,38B 'h/pr':195C 'h/ui':196C 'hard':68B 'high':7A,42B,74B,108C 'high-privileg':6A 'host':50B 'impact':78B,188C 'infrastructur':34B,94C,115C 'insert':136C 'integr':185C 'l':201C 'l/a':200C 'l/ac':194C 'l/i':199C 'let':40B 'limit':80B 'local':5A,44B 'logon':47B,112C 'n/s':197C 'need':73B 'on-prem':19B 'oracl':1A,22B,27B,89C 'part':51B 'partial':61B,169C,173C 'prem':21B 'privileg':8A,43B,75B,109C 'product':87C 'read':52B,152C 'result':132C 'score':182C 'server':33B,93C 'servic':64B,172C 'siebel':2A,24B,28B,56B,84C,90C,117C,123C,143C,158C,176C 'siebel-crm':23B 'subset':156C 'success':126C 'support':95C 'u/c':198C 'unauthor':134C,151C,164C 'updat':135C 'user':45B 'vector':190C 'vendor':26B 'version':96C 'vulner':81C,106C,130C 'well':149C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle Siebel CRM Deployment in the affected release range, in particular where users with logon to the server host have high privileges. Systems that do not run Siebel CRM Deployment can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91436","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91436","severity":null,"published_at":"2026-10-20T22:20:47+00:00","modified_at":"2026-10-23T21:17:27+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}