Oracle Siebel CRM CVE-2026-91413

Exploitation requires the attacker to already hold HIGH privileges (PR:H) on the Siebel CRM Development instance and network access to its CORBA interface serving the Integration - Scripting component. The specific limiting factor is this pre-existing privileged access - there is no unauthenticated path; no end-user interaction is needed (UI:N). Affected deployments are Siebel CRM Development versions 17.0 through 26.9. The primary realizable impact is a complete denial of service (application hang or repeatable crash), with secondary limited read and write access to a subset of Siebel-accessible data.

This is a moderate-severity issue (CVSS 3.1 base 6.0) whose real-world priority is constrained chiefly by its privilege requirement. The provided vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H shows network reachability (via CORBA) and low attack complexity, but PR:H means the attacker must already hold high privileges on the Siebel CRM Development instance, which substantially limits the realistic attacker population to insiders or those who have already compromised a privileged account. The dominant impact is availability (A:H, a complete hang or repeatable crash / DOS), with only partial confidentiality and integrity impact (C:L/I:L). No EPSS score, CISA KEV listing, POC, SSVC decision, or CWE was supplied in the input, so exploitation likelihood cannot be quantified from the data; exploitation status is therefore 'no public exploit identified at time of analysis.' Oracle itself labels the vulnerability 'easily exploitable,' which is consistent with AC:L, but 'easily exploitable' refers to the technical act after privileges are obtained and should not be read as low barrier to entry given PR:H. Net: this is a real but not emergency-tier issue - patch in the normal Oracle CPU cycle rather than treat as a drop-everything item, unless privileged account hygiene on Siebel is weak in your environment.

A user or attacker who already possesses high-privilege access to a Siebel CRM Development instance sends crafted input over the network via the CORBA interface to the Integration - Scripting component. The malformed request causes a hang or repeatable crash, producing a complete denial of service, and can also enable limited unauthorized read, update, insert, or delete of some Siebel data. No public exploit code was identified in the provided data, and exploitation requires pre-existing high privileges.