Oracle Siebel CRM CVE-2026-91389

Exploitation requires the attacker to hold a valid low-privileged authenticated account on the Siebel CRM End User application (PR:L) and to deliver a payload via the Open UI component over HTTP. Critically, it also requires human interaction from a different user (UI:R) - a second person must view or interact with the attacker-supplied content for the attack to succeed, which executes in that victim's session and crosses a security scope (S:C) to affect additional products. Limiting factors: no impact without a victim taking the bait, credentialed access is needed up front, and only partial read plus limited insert/update/delete are achievable (no availability impact). Affected deployments are Siebel CRM End User versions 17.0 through 26.9 running the Open UI component.

This is a moderate-severity (CVSS 3.1 base 5.4), not a top-tier emergency. The vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) describes a network-reachable, low-complexity flaw that nonetheless requires BOTH an authenticated low-privileged session (PR:L) AND human interaction from a victim other than the attacker (UI:R) - the classic signature of a stored/reflected cross-site-scripting-style issue in Oracle's web UIs, not a direct unauthenticated compromise. The limited, partial Confidentiality and Integrity impact (C:L/I:L) with no Availability impact, combined with the scope change (S:C) indicating the injected content executes in a victim's browser against other products/sessions, reinforces an XSS-type read/write-via-victim model rather than server-side code execution. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no signal of active or imminent exploitation - exploitation status is 'no public exploit identified at time of analysis.' The dual prerequisites (valid low-priv credentials plus a tricked second user) meaningfully lower real-world risk below what the 'network, low-complexity' metrics alone might suggest. Note a TAG CONFLICT: the input tag 'Authentication Bypass' contradicts the CVSS vector, which explicitly requires privileges (PR:L) and victim interaction (UI:R) - this is almost certainly not an authentication bypass; verify categorization with the Oracle CPU advisory.

A low-privileged but authenticated Siebel CRM user injects a malicious payload into a field rendered by the Open UI component. When a higher-value user (e.g., an administrator or another operator) later views that record, the payload executes in their browser session, letting the attacker read a subset of data and perform limited unauthorized insert/update/delete actions in the victim's context. No public exploit code is known at time of analysis, and success depends on luring or waiting for a second human to view the crafted content.