---
id: "CVE-2026-91436"
kind: "vulnerability"
aliases: ["CVE-2026-91436"]
title: "Oracle Siebel CRM Deployment: local high-privilege flaw exposes some data"
severity: "low"
cvss: 3.9
epss: 0.00112
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["on-prem", "oracle", "siebel-crm", "vendor"]
not_affected_if: ["not-siebel-deployment"]
published_at: "2026-10-20T22:20:47+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-25T12:38:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91436", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91436", "first_seen_at": "2026-10-25T12:38:52+00:00"}]
---

# Oracle Siebel CRM Deployment: local high-privilege flaw exposes some data

Oracle Siebel CRM Deployment, in the Server Infrastructure component, has a flaw that lets a highly privileged local user with logon to the host partly read, change, or delete Siebel data and cause a partial denial of service. The attack is hard to carry out and needs high privileges, so the impact is limited.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether any Siebel CRM Deployment version from `17.0` through `26.9` is installed; the sources do not give a command for this.

## Fix

- Apply the Oracle Siebel CRM security patch for the affected release; the sources do not name the fixed version.

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91436
- 2026-10-25T12:38:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91436

## From the sources

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel CRM Deployment accessible data as well as  unauthorized read access to a subset of Siebel CRM Deployment accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Siebel CRM Deployment. CVSS 3.1 Base Score 3.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_