Siebel CRM Deployment CVE-2026-91414

Exploitation requires the Siebel CRM Deployment Server Infrastructure to be network-reachable over HTTP and, critically, requires human interaction from a victim other than the attacker (UI:R) - e.g., an authorized user following or opening an attacker-supplied request/link. The CVSS AC:H further indicates additional conditions beyond the attacker's control must be satisfied for success, which meaningfully limits reliability and rules out unattended, fully automated exploitation. No authentication is needed by the attacker (PR:N per CVSS vector), but the dependence on a victim action and the high complexity are the primary limiting factors; scope is unchanged (S:U) and only confidentiality is affected.

This is a moderate, not top-tier, priority. The CVSS 3.1 base score is 5.3 (MEDIUM) with vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N: although it is network-reachable and unauthenticated (PR:N), two factors strongly suppress real-world risk - high attack complexity (AC:H), meaning conditions outside the attacker's control must be met, and required user interaction (UI:R) from a victim other than the attacker. Impact is confidentiality-only (C:H, I:N, A:N), so this is an information-disclosure issue, not a path to code execution or tampering. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of exploitation; per the precision rules this is 'no public exploit identified at time of analysis.' There is one notable conflict to flag: the input Tag 'Authentication Bypass' is inconsistent with both the Oracle description (which describes unauthorized read access to data requiring victim interaction, not a bypass of authentication) and the CVSS impact profile (C:H only) - treat the tag as unverified and rely on the Oracle advisory wording. Overall: a real but lower-urgency confidentiality flaw whose AC:H + UI:R requirements make mass or automated exploitation unlikely; prioritize behind any network-exploitable, no-interaction Siebel CPU items.

An unauthenticated attacker crafts a malicious HTTP request or link targeting the Siebel CRM Deployment Server Infrastructure component and lures a legitimate Siebel user into interacting with it (e.g., opening a crafted link). When the complex preconditions are met, the attacker gains unauthorized read access to sensitive Siebel CRM data accessible to that context. No public exploit code is identified at time of analysis, and the high attack complexity plus required user interaction make reliable exploitation difficult.