{"id":"CVE-2026-91441","kind":"vulnerability","aliases":["CVE-2026-91441"],"related":[],"title":"Oracle Siebel Order Management: low-privilege HTTP flaw allows data changes and reads","description":"Vulnerability in the Siebel Apps - Customer Order Management product of Oracle Siebel CRM (component: Order Management).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Apps - Customer Order Management.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel Apps - Customer Order Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel Apps - Customer Order Management accessible data as well as  unauthorized read access to a subset of Siebel Apps - Customer Order Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Siebel Apps - Customer Order Management. CVSS 3.1 Base Score 6.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L).","summary":"Oracle Siebel CRM's Customer Order Management component, versions 17.0 through 26.9, has a flaw reachable over HTTP by a low-privileged user. A successful attack, which needs a second person to interact, can read, change or delete some accessible order data and partly disrupt the service.","severity":"medium","cvss":6.5,"epss":0.00192,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["crm","enterprise","oracle","order-management","siebel","vendor"],"not_affected_if":["not-siebel","outside-affected-versions"],"how_to_check":"- Confirm the installed Siebel Customer Order Management release and compare it with the affected range 17.0-26.9\n- Check whether Oracle's patch or security alert for this CVE is listed for your Siebel release","fix":"- Apply the Oracle Siebel CRM patch for Customer Order Management that covers this CVE (patch identifier unknown in the sources)\n- Check the Oracle Critical Patch Update advisory for the fixed release","status":"open","published_at":"2026-10-20T22:20:47+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T03:49:27+00:00","updated_at":"2026-10-25T12:38:52+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-10-25T03:49:27Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Siebel CRM patch for Customer Order Management that covers this CVE (patch identifier unknown in the sources)\n- Check the Oracle Critical Patch Update advisory for the fixed release","reach":"network","title":"Oracle Siebel Order Management: low-privilege HTTP flaw allows data changes and reads","impact":"medium","summary":"Oracle Siebel CRM's Customer Order Management component, versions 17.0 through 26.9, has a flaw reachable over HTTP by a low-privileged user. A successful attack, which needs a second person to interact, can read, change or delete some accessible order data and partly disrupt the service.","category":"vendor","nicknames":[],"who_cares":["siebel","oracle","crm","order-management","enterprise"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker reads, changes or deletes some order data and partly disrupts service","analyst_note":"Find the Oracle patch identifier and fixed release for the Siebel Customer Order Management range 17.0-26.9 in the Oracle CPU advisory; the sources give no fix or check steps.","how_to_check":"- Confirm the installed Siebel Customer Order Management release and compare it with the affected range 17.0-26.9\n- Check whether Oracle's patch or security alert for this CVE is listed for your Siebel release","needs_analyst":true,"not_affected_if":["not-siebel","outside-affected-versions"],"who_is_affected":"Organizations running Oracle Siebel CRM Customer Order Management in the affected version range, reachable over HTTP by users with low-privilege accounts. Teams not running Siebel, or running versions outside 17.0-26.9, can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000681,"input_tokens":3623,"output_tokens":637,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-26.9':100C '-91441':17A,20A '/av':224C '17.0':38B,99C '26.9':40B '3.1':211C,223C '6.5':214C 'abil':194C 'access':69B,110C,164C,173C,180C,190C 'addit':147C 'affect':97C 'allow':10A,104C 'app':81C,116C,139C,169C,186C,206C 'attack':55B,107C,121C,131C,143C,152C 'avail':218C 'base':212C 'c/c':229C 'caus':196C 'chang':12A,65B,150C 'compon':36B,90C 'compromis':114C 'confidenti':215C 'crm':21B,31B,89C 'custom':33B,82C,117C,140C,170C,187C,207C 'cve':15A,18A 'cvss':210C,220C,222C 'data':11A,71B,174C,191C 'delet':67B,163C 'denial':199C 'disrupt':74B 'dos':203C 'easili':101C 'enterpris':22B 'exploit':102C 'flaw':9A,43B 'http':8A,46B,112C 'human':123C 'impact':146C,219C 'insert':161C 'integr':216C 'interact':62B,124C 'l':232C 'l/a':231C 'l/i':230C 'l/pr':226C 'l/ui':227C 'low':6A,50B,105C 'low-privileg':5A,49B 'manag':4A,26B,35B,84C,92C,119C,142C,172C,189C,209C 'may':144C 'n/ac':225C 'need':57B 'network':109C 'oracl':1A,23B,29B,87C 'order':3A,25B,34B,70B,83C,91C,118C,141C,171C,188C,208C 'order-manag':24B 'part':73B 'partial':198C,202C 'person':60B,127C 'privileg':7A,51B,106C 'product':85C,148C 'r/s':228C 'reachabl':44B 'read':14A,64B,179C 'requir':122C 'result':157C 'scope':149C 'score':213C 'second':59B 'servic':76B,201C 'siebel':2A,27B,30B,80C,88C,115C,138C,168C,185C,205C 'signific':145C 'subset':183C 'success':54B,120C,151C 'support':93C 'unauthor':159C,178C,193C 'updat':160C 'user':52B 'vector':221C 'vendor':28B 'version':37B,94C 'via':111C 'vulner':77C,103C,135C,155C 'well':176C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle Siebel CRM Customer Order Management in the affected version range, reachable over HTTP by users with low-privilege accounts. Teams not running Siebel, or running versions outside 17.0-26.9, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91441","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91441","severity":null,"published_at":"2026-10-20T22:20:47+00:00","modified_at":"2026-10-23T21:17:28+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91441","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91441","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:52+00:00","fetched_at":"2026-10-25T12:38:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}