---
id: "CVE-2026-91442"
kind: "vulnerability"
aliases: ["CVE-2026-91442"]
title: "Oracle Siebel CRM Deployment: low-privileged HTTP user can take over server"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Siebel CRM Deployment", "fixed": ["see Oracle CPU Oct 2026 (26.10 per Armis, unconfirmed)"], "affected": ">= 17.0, <= 26.9", "ecosystem": "vendor"}]
ecosystems: []
tags: ["enterprise", "oracle", "package", "self-hosted", "siebel-crm"]
not_affected_if: ["auth-required", "managed-hosting"]
published_at: "2026-10-20T22:20:47+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-23T23:54:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91442", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:54:00+00:00"}]
---

# Oracle Siebel CRM Deployment: low-privileged HTTP user can take over server

Oracle Siebel CRM Deployment 17.0 through 26.9 (component Server Infrastructure): a low-privileged attacker with HTTP network access can take over the deployment. CVSS 3.1 8.8 (CWE-269). Fixed by Oracle's October 2026 Critical Patch Update. No known exploitation or public PoC.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Siebel CRM Deployment affected >= 17.0, <= 26.9 fixed see Oracle CPU Oct 2026 (26.10 per Armis, unconfirmed)

## How to check

Check your Siebel CRM Deployment version: 17.0 through 26.9 is affected. Check whether the Siebel Server Infrastructure HTTP interface is reachable from untrusted networks, and which low-privilege accounts can reach it. Confirm in My Oracle Support whether the Oct 2026 CPU patch is applied.

## Fix

Apply the Siebel CRM patch from Oracle's October 2026 CPU via My Oracle Support. Armis says 26.10 or later, but I did not confirm this on Oracle's page. Until patched, limit HTTP access to Siebel servers to trusted networks and audit low-privilege accounts.

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91442
- 2026-10-23T23:54:00+00:00 analyst — Oracle CPU Oct 2026 (Oct 20) is the primary source; Rapid7/VulDB quote Oracle's text: Siebel CRM Deployment 17.0-26.9, Server Infrastructure, CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U), CWE-269. Fixed version 26.10 comes only from Armis and is an inference; I did not read Oracle's Siebel matrix row (page truncated). No KEV, no PoC, no exploitation found. Social posts not searched. Sibling CVE-2026-101446 (Siebel Cloud Manager) is a different component.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] Rapid7: CVE-2026-91442 (Oracle CNA text, CVSS 8.8) https://www.rapid7.com/db/vulnerabilities/cve-2026-91442/
- [mentions] Armis: CVE-2026-91442 https://cve.armis.com/CVE-2026-91442

## From the sources

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in takeover of Siebel CRM Deployment. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_