{"id":"CVE-2026-91442","kind":"vulnerability","aliases":["CVE-2026-91442"],"related":[],"title":"Oracle Siebel CRM Deployment: low-privileged HTTP user can take over server","description":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in takeover of Siebel CRM Deployment. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Siebel CRM Deployment 17.0 through 26.9 (component Server Infrastructure): a low-privileged attacker with HTTP network access can take over the deployment. CVSS 3.1 8.8 (CWE-269). Fixed by Oracle's October 2026 Critical Patch Update. No known exploitation or public PoC.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Siebel CRM Deployment","fixed":["see Oracle CPU Oct 2026 (26.10 per Armis, unconfirmed)"],"affected":">= 17.0, <= 26.9","ecosystem":"vendor"}],"ecosystems":[],"tags":["enterprise","oracle","package","self-hosted","siebel-crm"],"not_affected_if":["auth-required","managed-hosting"],"how_to_check":"Check your Siebel CRM Deployment version: 17.0 through 26.9 is affected. Check whether the Siebel Server Infrastructure HTTP interface is reachable from untrusted networks, and which low-privilege accounts can reach it. Confirm in My Oracle Support whether the Oct 2026 CPU patch is applied.","fix":"Apply the Siebel CRM patch from Oracle's October 2026 CPU via My Oracle Support. Armis says 26.10 or later, but I did not confirm this on Oracle's page. Until patched, limit HTTP access to Siebel servers to trusted networks and audit low-privilege accounts.","status":"open","published_at":"2026-10-20T22:20:47+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-23T22:33:57+00:00","updated_at":"2026-10-23T23:54:00+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T22:33:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle Siebel CRM Deployment: low-privileged HTTP user can take over server","impact":"high","summary":"Oracle Siebel CRM Deployment versions 17.0 through 26.9 have a flaw in the Server Infrastructure component. An attacker with a low-privilege account and network access over HTTP can fully take over the deployment.","category":"package","who_cares":["siebel-crm","oracle","enterprise"],"confidence":0.6,"needs_auth":"yes","worst_case":"attacker takes over the Siebel server, reads and changes its data","analyst_note":"Check Oracle's Critical Patch Update advisory for the fixed Siebel CRM Deployment version and the affected Server Infrastructure components; NVD gives no fix or patch details.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000483,"input_tokens":3068,"output_tokens":353,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Oracle's Critical Patch Update advisory for the fixed Siebel CRM Deployment version and the affected Server Infrastructure components; NVD gives no fix or patch details.","search":"'-2026':15A,18A '-26.9':97C '-269':60B '-91442':16A,19A '/av':142C '17.0':36B,96C '2026':66B '26.9':38B '3.1':57B,129C,141C '8.8':58B,132C 'access':50B,107C 'affect':94C 'allow':101C 'attack':46B,104C,116C 'avail':136C 'base':130C 'compon':39B,87C 'compromis':111C 'confidenti':133C 'critic':67B 'crm':3A,21A,31B,34B,80C,86C,113C,126C 'cve':14A,17A 'cvss':56B,128C,138C,140C 'cwe':59B 'deploy':4A,35B,55B,81C,114C,127C 'deployment':22A 'easili':98C 'enterpris':23B 'exploit':72B,99C 'fix':61B 'h':150C 'h/a':149C 'h/i':148C 'host':28B 'http':8A,48B,109C 'impact':137C 'infrastructur':41B,89C 'integr':134C 'known':71B 'l/pr':144C 'l/ui':145C 'low':6A,44B,102C 'low-privileg':5A,43B 'n/ac':143C 'n/s':146C 'network':49B,106C 'octob':65B 'oracl':1A,24B,32B,63B,84C 'packag':25B 'patch':68B 'poc':75B 'privileg':7A,45B,103C 'product':82C 'public':74B 'result':121C 'score':131C 'self':27B 'self-host':26B 'server':13A,40B,88C 'siebel':2A,20A,30B,33B,79C,85C,112C,125C 'siebel-crm':29B 'success':115C 'support':90C 'take':11A,52B 'takeov':123C 'u/c':147C 'updat':69B 'user':9A 'vector':139C 'version':91C 'via':108C 'vulner':76C,100C,119C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91442","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91442","severity":null,"published_at":"2026-10-20T22:20:47+00:00","modified_at":"2026-10-23T21:17:28+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91442:544","url":null,"severity":null,"published_at":"2026-10-23T23:54:00+00:00","modified_at":"2026-10-23T23:54:00+00:00","first_seen_at":"2026-10-23T23:54:00+00:00","fetched_at":"2026-10-23T23:54:00+00:00","note":"Oracle CPU Oct 2026 (Oct 20) is the primary source; Rapid7/VulDB quote Oracle's text: Siebel CRM Deployment 17.0-26.9, Server Infrastructure, CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U), CWE-269. Fixed version 26.10 comes only from Armis and is an inference; I did not read Oracle's Siebel matrix row (page truncated). No KEV, no PoC, no exploitation found. Social posts not searched. Sibling CVE-2026-101446 (Siebel Cloud Manager) is a different component."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2224,"url":"https://cve.armis.com/CVE-2026-91442","title":"Armis: CVE-2026-91442","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":2225,"url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-91442/","title":"Rapid7: CVE-2026-91442 (Oracle CNA text, CVSS 8.8)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}