Siebel CRM CVE-2026-91393

Exploitation requires the attacker to induce human interaction from a legitimate Siebel CRM End User (UI:R) - the attacker cannot act alone, so a victim must be lured into clicking or loading attacker-controlled content against the Siebel Open UI over HTTP. No attacker authentication or privileges are needed (PR:N), but HIGH attack complexity (AC:H) indicates conditions outside the attacker's control (e.g., timing, specific session or application state) must be met, making reliable exploitation difficult. Impact is limited to unauthorized update/insert/delete of SOME data accessible to the targeted user; there is no data disclosure or availability impact. Limiting factors for defenders: the dependency on tricking an active Siebel user, the high-complexity preconditions, and the narrow integrity-only impact scoped to the victim's accessible data.

This is a genuinely LOW-priority issue despite being network-reachable. The CVSS 3.1 base score is 3.1 with vector AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N - network attack vector and no privileges required, but offset by HIGH attack complexity (AC:H), mandatory user interaction (UI:R), unchanged scope, and only a LOW integrity impact with no confidentiality or availability impact. Oracle itself describes it as 'difficult to exploit.' No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of real-world or opportunistic exploitation - exploitation status is 'no public exploit identified at time of analysis.' SSVC-style reasoning: exploitation=none observed, automatable=NO (requires per-victim human interaction and high complexity), technical impact=partial (limited unauthorized data modification only). The combination of AC:H + UI:R + I:L means an attacker cannot read data, cannot deny service, and can only make limited unauthorized update/insert/delete changes to some Siebel data, and only by luring a legitimate user into an action. Net: a real but minor integrity flaw, not an urgent patching priority. Note a tag discrepancy - the input is tagged 'Authentication Bypass,' which does not match the vulnerability (an integrity flaw requiring victim interaction, not a bypass of authentication); treat that tag as suspect.

An attacker crafts a malicious HTTP request or link targeting the Siebel CRM Open UI and tricks an authenticated Siebel end user into interacting with it (e.g., clicking a crafted link or loading attacker-controlled content). When the victim acts, the request causes limited unauthorized update, insert, or delete operations against data the victim can access. High attack complexity and the required human interaction make reliable exploitation difficult, and no public exploit code was identified in the provided data.