Oracle Siebel CRM CVE-2026-91387

Requires an authenticated low-privileged account on the Siebel CRM End User application (PR:L) with network HTTP access to the Open UI component; any affected release from 17.0 through 26.9 is in scope. No user interaction is required (UI:N) and attack complexity is low (AC:L), so a valid but low-privilege session is the only meaningful prerequisite. The limiting factor is that exploitation cannot be performed by a fully unauthenticated external attacker - this is an insider or compromised-credential threat, and impact is bounded (partial read plus some insert/update/delete, no availability loss).

This is a medium-severity, authenticated access-control flaw rather than a top-priority emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, base 5.4) describes a network-reachable, low-complexity attack that nonetheless REQUIRES a low-privileged authenticated account (PR:L) and yields only partial confidentiality and integrity impact with no availability impact. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided, so exploitation probability and automatability cannot be quantified from the input - treat the absence of those signals as unknown, not as evidence of low risk. Exploitation status is 'no public exploit identified at time of analysis.' A notable conflict exists in the metadata: the input carries an 'Authentication Bypass' tag, but both the description ('low privileged attacker') and the CVSS vector (PR:L) indicate the attacker must already be authenticated - this is NOT an authentication bypass, and the tag appears mislabeled. Overall this is a genuine but moderate risk: realistic for insider or compromised-account abuse within deployed Siebel environments, but not a widespread unauthenticated-RCE scenario; prioritize via Oracle's quarterly patch cycle rather than as an out-of-band fire drill.

An attacker who already holds a low-privileged Siebel CRM End User account (or has compromised one) sends crafted HTTP requests to the Open UI component over the network. Because attack complexity is low and no user interaction is required, the attacker can read a subset of data and perform unauthorized insert/update/delete operations on some accessible records. No public exploit code has been identified at the time of analysis.