{"id":"CVE-2026-91444","kind":"vulnerability","aliases":["CVE-2026-91444"],"related":[],"title":"Oracle Siebel CRM Deployment: local high-privilege flaw allows full takeover","description":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in takeover of Siebel CRM Deployment. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Siebel CRM Deployment has a flaw in its Server Infrastructure component, affecting supported versions 17.0 through 26.9. An attacker who already has high-privilege logon to the host running Siebel CRM Deployment can take over the product.","severity":"medium","cvss":6.7,"epss":0.00117,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["on-prem","oracle","other","self-hosted","siebel-crm"],"not_affected_if":["not-running-siebel","patched-version"],"how_to_check":"- Confirm the installed Siebel CRM Deployment version, affected range is `17.0` through `26.9`\n- Check Oracle's Critical Patch Update advisory for the patched release unknown","fix":"- Apply the Oracle Siebel CRM patch for the Server Infrastructure component (patched version unknown from the sources)\n- Restrict high-privilege logon to Siebel hosts until patched","status":"open","published_at":"2026-10-20T22:20:48+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T03:46:34+00:00","updated_at":"2026-10-25T12:38:52+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-25T03:46:34Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Siebel CRM patch for the Server Infrastructure component (patched version unknown from the sources)\n- Restrict high-privilege logon to Siebel hosts until patched","reach":"local","title":"Oracle Siebel CRM Deployment: local high-privilege flaw allows full takeover","impact":"high","summary":"Oracle Siebel CRM Deployment has a flaw in its Server Infrastructure component, affecting supported versions 17.0 through 26.9. An attacker who already has high-privilege logon to the host running Siebel CRM Deployment can take over the product.","category":"other","nicknames":[],"who_cares":["siebel-crm","oracle","self-hosted","on-prem"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker with high-privilege logon takes over Siebel CRM Deployment completely","analyst_note":"Find the Oracle CPU advisory and patched release numbers for Siebel CRM Deployment 17.0-26.9 to fill in the fix.","how_to_check":"- Confirm the installed Siebel CRM Deployment version, affected range is `17.0` through `26.9`\n- Check Oracle's Critical Patch Update advisory for the patched release unknown","needs_analyst":true,"not_affected_if":["not-running-siebel","patched-version"],"who_is_affected":"Organisations running Oracle Siebel CRM Deployment in the affected version range on servers where privileged users can log on. The attack needs local access with high privileges, so exposure is mainly a concern for shared or weakly controlled admin hosts. Teams not running Siebel CRM can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000653,"input_tokens":3475,"output_tokens":611,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-26.9':90C '-91444':15A,18A '/av':140C '17.0':45B,89C '26.9':47B '3.1':127C,139C '6.7':130C 'affect':42B,87C 'allow':10A,94C 'alreadi':51B 'attack':49B,97C,114C 'avail':134C 'base':128C 'compon':41B,80C 'compromis':109C 'confidenti':131C 'crm':3A,29B,32B,62B,73C,79C,105C,111C,124C 'cve':13A,16A 'cvss':126C,136C,138C 'deploy':4A,33B,63B,74C,106C,112C,125C 'easili':91C 'execut':107C 'exploit':92C 'flaw':9A,36B 'full':11A 'h':148C 'h/a':147C 'h/i':146C 'h/ui':143C 'high':7A,54B,95C 'high-privileg':6A,53B 'host':26B,59B 'impact':135C 'infrastructur':40B,82C,102C 'integr':132C 'l/ac':141C 'l/pr':142C 'local':5A 'logon':56B,99C 'n/s':144C 'on-prem':19B 'oracl':1A,22B,30B,77C 'prem':21B 'privileg':8A,55B,96C 'product':68B,75C 'result':119C 'run':60B 'score':129C 'self':25B 'self-host':24B 'server':39B,81C 'siebel':2A,28B,31B,61B,72C,78C,104C,110C,123C 'siebel-crm':27B 'success':113C 'support':43B,83C 'take':65B 'takeov':12A,121C 'u/c':145C 'vector':137C 'version':44B,84C 'vulner':69C,93C,117C","nicknames":[],"mitigations":[],"who_affected":"Organisations running Oracle Siebel CRM Deployment in the affected version range on servers where privileged users can log on. The attack needs local access with high privileges, so exposure is mainly a concern for shared or weakly controlled admin hosts. Teams not running Siebel CRM can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91444","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91444","severity":null,"published_at":"2026-10-20T22:20:48+00:00","modified_at":"2026-10-23T21:17:28+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91444","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91444","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:52+00:00","fetched_at":"2026-10-25T12:38:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}