Oracle Siebel CRM CVE-2026-91391

Exploitation targets the Open UI component of Siebel CRM End User and requires HTTP network access to the Siebel application; no credentials and no user interaction are needed (PR:N/UI:N). The dominant limiting factor is the high attack complexity (AC:H): success depends on specific, attacker-uncontrollable conditions that Oracle does not enumerate, making reliable exploitation difficult. Affected deployments are Siebel CRM End User versions 17.0 through 26.9; impact is confined to unauthorized read access to a subset of accessible data, with no ability to modify data or affect availability.

This is a genuinely low-priority issue despite being remotely reachable. The CVSS 3.1 base score of 3.7 (LOW) is driven by AV:N/PR:N/UI:N (network-accessible, unauthenticated, no user interaction) but heavily tempered by AC:H (high attack complexity) and an impact limited to C:L with no integrity or availability effect (I:N/A:N). In practice this means an attacker could reach it over HTTP without credentials, but success depends on conditions outside the attacker's control, and the payoff is read access to only a subset of Siebel CRM data. No EPSS score, no CISA KEV listing, and no public exploit were provided in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The one point of friction worth flagging: the input Tags include 'Authentication Bypass,' which conflicts with the description - the vulnerability is an unauthorized read-access/information-disclosure issue (C:L only, I:N), not a privilege or authentication bypass; treat that tag as suspect. Overall this is a high-complexity, low-impact disclosure flaw that should be patched in the normal Oracle Critical Patch Update cycle rather than treated as an emergency.

A remote, unauthenticated attacker sends specially crafted HTTP requests to an internet- or network-reachable Siebel CRM Open UI endpoint, exploiting the flaw to read a limited subset of application data they should not be able to see. Because the CVSS vector specifies AC:H, the attack requires specific conditions or timing to succeed and is not reliably repeatable. No public proof-of-concept exploit was identified in the provided data.