Oracle Siebel CRM CVE-2026-91390

Exploitation requires the Siebel CRM Open UI client interface to be in use and network HTTP access to the application. The attacker must hold a valid low-privileged Siebel account (PR:L), and successful attack depends on a DIFFERENT user (UI:R) - e.g., an agent or administrator - subsequently interacting with the attacker-controlled content, which executes in that victim's authenticated session. Affected deployments run Siebel CRM End User versions 17.0 through 26.9. Limiting factors: no exploitation against anonymous/unauthenticated users, no fully automated mass exploitation (human interaction mandatory), and impact is partial read plus limited data modification with no availability effect; the scope change means consequences can extend to products integrated with Siebel beyond the vulnerable component.

This is a moderate-severity, mid-tier-priority issue rather than a drop-everything emergency. The CVSS 3.1 base score is 5.4 with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N: network-reachable and low-complexity, but it requires an already-authenticated low-privileged account (PR:L) AND social-engineering of a separate victim user (UI:R), which materially lowers real-world exploitability. The scope change (S:C) is the most notable amplifier - the vulnerability lives in the Siebel Open UI layer but 'may significantly impact additional products,' consistent with a client-side injection (e.g., stored/reflected XSS) that executes in another user's authenticated session. Impact is partial (C:L/I:L, A:N): limited read plus limited unauthorized update/insert/delete of Siebel data, no availability loss. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no signal of active or imminent exploitation - this contradicts the 'Authentication Bypass' tag, which does not match a flaw that explicitly requires privileges (PR:L) and victim interaction (UI:R). Net: patch in a normal prioritized cycle; it is not a low-real-risk false alarm given the scope change and CRM data exposure, but the auth + user-interaction prerequisites keep it well below critical.

An attacker with a low-privileged but legitimate Siebel CRM account injects a malicious payload (likely script) into a Siebel Open UI field or parameter. When another user - such as a CRM agent or administrator - views that content in their authenticated session, the payload executes in their browser context, letting the attacker read a subset of data and perform unauthorized insert/update/delete actions, potentially reaching other integrated products due to the scope change. No public exploit code was identified at time of analysis.