Oracle Siebel CRM CVE-2026-91388

Exploitation targets the Siebel CRM Open UI component over HTTP and requires active interaction from a victim user other than the attacker (UI:R) - the attacker cannot trigger it alone and must get a legitimate Siebel end user to click or load attacker-controlled content. Oracle rates the attack high-complexity (AC:H), implying additional conditions beyond attacker control (e.g., timing, specific application state, or user context) must align. No authentication is required of the attacker (PR:N). Key limiting factors: mandatory user interaction, high attack complexity, and impact capped at low confidentiality/integrity with no availability loss, though the scope change can extend consequences to other integrated products.

This is a moderate-severity, hard-to-exploit issue that does NOT warrant emergency prioritization. The CVSS 3.1 base score is 4.7 (Medium) with vector AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N: while network-reachable and unauthenticated (PR:N), exploitation is explicitly rated high-complexity (AC:H) and requires human interaction from a victim other than the attacker (UI:R), which substantially dampens real-world exploitability. Impact is limited to low confidentiality and low integrity (partial read and some update/insert/delete), with no availability impact. The scope change (S:C) is the one aggravating signal - Oracle states attacks 'may significantly impact additional products' - but the overall impact remains low. No EPSS probability, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization; exploitation status is best treated as 'no public exploit identified at time of analysis.' Note a data conflict: the input Tags label this 'Authentication Bypass,' but the CVSS profile (UI:R, scope change, C:L/I:L, A:N against an Open UI web component) is far more consistent with a cross-site scripting / client-side injection flaw than an auth bypass - the tag should be verified against the Oracle advisory. Net: a real but lower-tier patch-cycle item, not a drop-everything priority.

An attacker crafts a malicious link or payload targeting the Siebel Open UI web interface and lures a legitimate Siebel CRM end user into interacting with it (e.g., clicking a link or loading attacker-influenced content). Because exploitation is high-complexity and requires that victim interaction, success is not reliable, but a successful attack lets the attacker read a subset of data and perform some unauthorized update/insert/delete in the victim's context, with potential impact spilling into other integrated products due to the scope change. No public exploit code was identified in the provided intelligence.