Live › vulnerability › CVE-2026-91441
Go to dashboardOracle Siebel CRM's Customer Order Management component, versions 17.0 through 26.9, has a flaw reachable over HTTP by a low-privileged user. A successful attack, which needs a second person to interact, can read, change or delete some accessible order data and partly disrupt the service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Organizations running Oracle Siebel CRM Customer Order Management in the affected version range, reachable over HTTP by users with low-privilege accounts. Teams not running Siebel, or running versions outside 17.0-26.9, can skip it.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the Siebel Apps - Customer Order Management product of Oracle Siebel CRM (component: Order Management). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Apps - Customer Order Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel Apps - Customer Order Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel Apps - Customer Order Management accessible data as well as unauthorized read access to a subset of Siebel Apps - Customer Order Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Siebel Apps - Customer Order Management. CVSS 3.1 Base Score 6.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L).
This page as .md · .json · in your agent: get_signal("CVE-2026-91441")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.