Siebel CRM Integration CVE-2026-91378

Exploitation requires human interaction from a person other than the attacker (CVSS UI:R) - a legitimate user must click a crafted link or render attacker-controlled content delivered to the Open Integration component of Siebel CRM Integration over HTTP; no attacker authentication is needed (PR:N). The scope change (S:C) means successful attacks can affect products beyond Siebel CRM Integration itself. The required user interaction is the primary limiting factor, preventing fully automated or unattended mass exploitation; exposure is further limited to deployments running affected versions 25.12 through 26.9 with the integration interface reachable to attackers (e.g., internet-facing). No non-default configuration prerequisite is stated in the description.

This is a moderate-severity (CVSS 3.1 base 6.1) vulnerability in Oracle Siebel CRM Integration (Open Integration component). The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N describes a network-reachable, low-complexity, unauthenticated flaw that requires victim interaction, produces a scope change, and yields only low confidentiality and low integrity impact with no availability impact - a signature that strongly matches a stored/reflected cross-site scripting (XSS) class issue rather than a direct server-compromise bug, despite the 'Authentication Bypass' tag which appears inconsistent with the mechanics (an unauthenticated UI:R/scope-change/C:L-I:L bug is not an auth bypass). On exploitation signals: no EPSS score was provided, the CVE is NOT in CISA KEV, and no public POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' The mandatory UI:R requirement (a human other than the attacker must act) materially lowers real-world risk and makes mass, unattended exploitation unlikely. Net assessment: a genuine but mid-tier priority - patch in normal cycle rather than emergency, prioritizing internet-facing Siebel deployments. Key missing data: no EPSS, no KEV, no CWE (listed N/A), and the only reference is the Oracle October 2026 CPU landing page, not a CVE-specific advisory, so impact details rely on the NVD/Oracle description text.

An unauthenticated attacker crafts a malicious HTTP request or link targeting the Open Integration interface of Siebel CRM Integration and lures an authenticated Siebel user to interact with it. When the victim's browser processes the attacker-controlled content, script executes in the victim's session context, and because of the scope change the impact can extend to additional connected products, allowing limited unauthorized read of some data and unauthorized insert/update/delete of a subset of accessible data. No public exploit code is identified at time of analysis, and exploitation hinges on tricking a legitimate user into interacting.