Oracle Siebel CRM CVE-2026-91392

Exploitation targets the Siebel Open UI component of Oracle Siebel CRM End User, versions 17.0 through 26.9, reachable over HTTP by an unauthenticated network attacker (no credentials or user interaction required per PR:N/UI:N). The key LIMITING factor is high attack complexity (AC:H): Oracle explicitly rates this as 'difficult to exploit,' implying success depends on conditions outside the attacker's direct control (e.g. timing/race or a specific transient state) rather than a single deterministic request. Impact is confined to unauthorized update/insert/delete of SOME accessible data (I:L) with no read access to confidential data and no availability impact, further bounding realistic risk.

This is a low-severity integrity-only issue (CVSS 3.1 base 3.7) that is unlikely to be a top patching priority despite being network-reachable and unauthenticated. The CVSS vector (AV:N/PR:N/UI:N) looks alarming on the surface - remote, no authentication, no user interaction - but the mitigating signals dominate: AC:H means exploitation is difficult and non-deterministic (likely requiring a race, specific timing, or attacker-uncontrollable preconditions), and impact is limited to I:L with C:N and A:N, i.e. only partial unauthorized update/insert/delete to SOME accessible data, with no confidentiality or availability consequences. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no evidence of active or imminent exploitation; Oracle's own high attack-complexity rating argues against easy weaponization. The input Tag 'Authentication Bypass' is not clearly supported by the description - the flaw is described as unauthorized data modification by an unauthenticated attacker, not a bypass of an authentication mechanism - so that label should be treated with skepticism and verified against the Oracle CPU advisory. Overall: a genuine but minor, hard-to-exploit integrity defect that belongs in routine quarterly Oracle CPU patching rather than emergency response.

A remote, unauthenticated attacker sends crafted HTTP requests to the internet- or intranet-exposed Siebel Open UI interface, exploiting a high-complexity flaw to perform unauthorized update, insert, or delete operations against a subset of application data. Because the CVSS marks AC:H, success likely depends on winning a race condition or hitting a narrow, attacker-uncontrollable condition, so reliable exploitation is not guaranteed. No public exploit code was identified at the time of analysis.