Oracle Siebel CRM CVE-2026-91367

Exploitation requires the attacker to have valid low-privilege logon access to the operating-system/infrastructure layer where Siebel CRM Cloud Applications (Siebel Cloud Manager component) executes - this is a local vector (AV:L), not remote network access. Affected deployments are supported Siebel CRM Cloud Applications versions 22.3 through 26.9. Limiting factors: the requirement for pre-existing authenticated local access (PR:L) sharply reduces the attacker population to insiders or those who have already breached the host, and no user interaction is needed (UI:N). The scope change (S:C) means the realistic impact depends on what additional products and data the Siebel host can reach. Impact is confined to confidentiality (C:H); there is no integrity or availability impact, so this cannot be used to modify data or cause outages.

The CVSS 3.1 base score is 6.5 (Medium), driven by the vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - a locally-accessible, low-complexity flaw requiring low privileges, with a scope change and high confidentiality impact (no integrity or availability impact). The key risk-limiting signal is AV:L combined with PR:L: an attacker must already have logon access to the infrastructure hosting Siebel CRM Cloud Applications, which meaningfully narrows the exploitation population to insiders or attackers who have already gained a foothold. The elevating signal is the scope change (S:C), meaning a successful attack can reach data in other products beyond the vulnerable component. No EPSS score, KEV listing, or POC is present in the input, so there is no evidence of active exploitation or published exploit code at this time; this appears to be a standard Oracle Critical Patch Update disclosure rather than an emergency. CONFLICT TO VERIFY: the input tag labels this 'Authentication Bypass,' but the CVSS vector specifies PR:L and the description states the attacker needs 'logon to the infrastructure' - these are contradictory, since an authenticated-local flaw is not an auth bypass. Treat the 'Authentication Bypass' characterization as unverified. Overall this is a moderate-priority, patch-in-normal-cycle issue rather than a drop-everything emergency, with real risk concentrated in environments where many low-privilege users share the Siebel host infrastructure.

A low-privileged user (or an attacker who has already obtained a local account) logs on to the infrastructure where Siebel CRM Cloud Applications runs and abuses the Siebel Cloud Manager component to read critical data they should not have access to. Because the attack causes a scope change, the exposure can extend beyond Siebel itself to data in additional connected products. No public exploit code is identified at time of analysis, and exploitation requires low attack complexity but pre-existing local logon access.