Oracle Siebel CRM CVE-2026-91366

Exploitation requires the attacker to have access to the physical communication segment attached to the hardware on which Siebel CRM Cloud Applications (Siebel Cloud Manager component) runs - i.e., adjacent-network positioning (AV:A), NOT remote internet access. Additionally, the attack is explicitly 'difficult to exploit' (AC:H), implying success depends on timing, race, or positioning conditions the attacker cannot fully control. Limiting factors that reduce realistic risk: the segment-access prerequisite confines exploitation to insiders, compromised adjacent hosts, or those with data-center/VLAN presence; no authentication is needed (PR:N) and no user interaction (UI:N), but the adjacency and high-complexity requirements are strong practical barriers. Affects Siebel CRM Cloud Applications versions 22.3 through 26.9.

This is a genuinely low-to-moderate priority issue despite a CRITICAL-sounding scope change. The CVSS 3.1 base score is 4.7 (Medium), and the vector tells the real story: AV:A means the attacker must be on the adjacent/physical communication segment attached to the Siebel hardware - not reachable over the open internet - and AC:H confirms Oracle's own text that the flaw is 'difficult to exploit,' implying timing, positioning, or race conditions outside attacker control. PR:N (unauthenticated) and UI:N raise the score somewhat, and S:C (scope change) reflects that successful attacks may impact additional products beyond Siebel itself. However, impact is capped at C:L/I:L with A:N - partial read plus limited update/insert/delete, no availability loss. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no signal of real-world exploitation; the combination of adjacent-only access and high complexity makes opportunistic or automated exploitation unlikely. The input Tag 'Authentication Bypass' is not supported by the description, which never mentions bypassing authentication - the PR:N simply reflects that no credentials are required for the adjacent-network vector; treat that tag with skepticism. Net: a real-but-bounded insider/local-segment risk, not an urgent internet-facing emergency.

An attacker who has already gained a foothold on the same physical or logical network segment as the Siebel CRM Cloud hardware (e.g., a malicious insider, a compromised adjacent host, or someone with data-center/VLAN access) manipulates traffic to the Siebel Cloud Manager component. By winning the difficult timing or positioning conditions (AC:H), they achieve limited unauthorized read plus update/insert/delete on a subset of Siebel data, with effects potentially spilling into additional products due to the scope change. No public exploit code is identified at time of analysis, so this would require a bespoke, well-positioned effort.