{"id":"CVE-2026-91443","kind":"vulnerability","aliases":["CVE-2026-91443"],"related":[],"title":"Oracle Siebel CRM Deployment: low-privilege HTTP attacker reads critical data","description":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","summary":"Oracle Siebel CRM Deployment, in the Server Infrastructure component, has a flaw in versions 17.0 through 26.9. An attacker with a low-privilege account and network access over HTTP can gain unauthorized access to critical data the deployment holds.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["crm","oracle-siebel","self-hosted","vendor"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed Siebel CRM Deployment version against the affected range `17.0` through `26.9`\n- unknown","fix":"- Apply the Oracle Critical Patch Update fix for Siebel CRM Deployment; the sources do not name the fixed version\n- unknown","status":"open","published_at":"2026-10-20T22:20:47+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T03:49:26+00:00","updated_at":"2026-10-25T03:49:26+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:49:26Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Siebel CRM Deployment; the sources do not name the fixed version\n- unknown","reach":"network","title":"Oracle Siebel CRM Deployment: low-privilege HTTP attacker reads critical data","impact":"medium","summary":"Oracle Siebel CRM Deployment, in the Server Infrastructure component, has a flaw in versions 17.0 through 26.9. An attacker with a low-privilege account and network access over HTTP can gain unauthorized access to critical data the deployment holds.","category":"vendor","nicknames":[],"who_cares":["oracle-siebel","crm","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads critical and all Siebel CRM accessible data","analyst_note":"Find the Oracle Siebel CRM Critical Patch Update advisory for the fixed version and the exact deployment configurations affected, via https://nvd.nist.gov/vuln/detail/CVE-2026-91443.","how_to_check":"- Check the installed Siebel CRM Deployment version against the affected range `17.0` through `26.9`\n- unknown","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running Oracle Siebel CRM Deployment versions 17.0 through 26.9 with HTTP access reachable by low-privileged users. The sources do not say which deployment configurations are exposed, so unknown for anything narrower than that version range.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000631,"input_tokens":3467,"output_tokens":568,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-26.9':88C '-91443':15A,18A '/av':140C '17.0':41B,87C '26.9':43B '3.1':130C,139C '6.5':133C 'access':54B,60B,98C,115C,121C,127C 'account':51B 'affect':85C 'allow':92C 'attack':9A,45B,95C,107C 'base':131C 'complet':120C 'compon':35B,78C 'compromis':102C 'confidenti':134C 'critic':11A,62B,117C 'crm':3A,19B,29B,71C,77C,104C,125C 'cve':13A,16A 'cvss':129C,136C,138C 'data':12A,63B,118C,128C 'deploy':4A,30B,65B,72C,105C,126C 'easili':89C 'exploit':90C 'flaw':38B 'gain':58B 'h/i':146C 'hold':66B 'host':25B 'http':8A,56B,100C 'impact':135C 'infrastructur':34B,80C 'l/pr':142C 'l/ui':143C 'low':6A,49B,93C 'low-privileg':5A,48B 'n':148C 'n/a':147C 'n/ac':141C 'n/s':144C 'network':53B,97C 'oracl':1A,21B,27B,75C 'oracle-siebel':20B 'privileg':7A,50B,94C 'product':73C 'read':10A 'result':112C 'score':132C 'self':24B 'self-host':23B 'server':33B,79C 'siebel':2A,22B,28B,70C,76C,103C,124C 'success':106C 'support':81C 'u/c':145C 'unauthor':59B,114C 'vector':137C 'vendor':26B 'version':40B,82C 'via':99C 'vulner':67C,91C,110C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle Siebel CRM Deployment versions 17.0 through 26.9 with HTTP access reachable by low-privileged users. The sources do not say which deployment configurations are exposed, so unknown for anything narrower than that version range.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91443","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91443","severity":null,"published_at":"2026-10-20T22:20:47+00:00","modified_at":"2026-10-23T21:17:28+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}