How do I check whether I am affected by CVE-2026-91442?

Check your Siebel CRM Deployment version: 17.0 through 26.9 is affected. Check whether the Siebel Server Infrastructure HTTP interface is reachable from untrusted networks, and which low-privilege accounts can reach it. Confirm in My Oracle Support whether the Oct 2026 CPU patch is applied.

What is the fix for CVE-2026-91442?

Apply the Siebel CRM patch from Oracle's October 2026 CPU via My Oracle Support. Armis says 26.10 or later, but I did not confirm this on Oracle's page. Until patched, limit HTTP access to Siebel servers to trusted networks and audit low-privilege accounts.

Who is not affected by CVE-2026-91442?

Not affected if: auth-required, managed-hosting.

Live › vulnerability › CVE-2026-91442

Go to dashboard

high8.8Package

Oracle Siebel CRM Deployment: low-privileged HTTP user can take over server

Oracle Siebel CRM Deployment 17.0 through 26.9 (component Server Infrastructure): a low-privileged attacker with HTTP network access can take over the deployment. CVSS 3.1 8.8 (CWE-269). Fixed by Oracle's October 2026 Critical Patch Update. No known exploitation or public PoC.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

8.8

high

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Attacker takes over the Siebel server, reads and changes its data.
CVSS said: 8.8. The facts above say medium; we keep the sources' high until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-91442

Go to dashboard

high8.8Package

Oracle Siebel CRM Deployment: low-privileged HTTP user can take over server

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

8.8

high

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Attacker takes over the Siebel server, reads and changes its data.
CVSS said: 8.8. The facts above say medium; we keep the sources' high until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Oracle Siebel CRM Deployment: low-privileged HTTP user can take over server

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

Oracle Siebel CRM Deployment: low-privileged HTTP user can take over server

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources