Siebel CRM Deployment CVE-2026-91421

Exploitation targets the Siebel CRM Deployment Server Infrastructure component and is reachable by an unauthenticated attacker over HTTP (PR:N, AV:N), so no credentials or user interaction are required. However, the CVSS vector's AC:H indicates high attack complexity: successful attacks depend on conditions outside the attacker's direct control - likely specific server state, timing, or request characteristics that Oracle has not disclosed - which limits reliable, repeatable exploitation. Realistic risk is further bounded by the fact that impact is limited to availability (complete DOS); there is no path to data disclosure, modification, or code execution. Affected deployments are Siebel CRM Deployment versions 17.0 through 26.9 exposing HTTP-facing server infrastructure to the attacker's network.

This is a moderate-severity availability-only vulnerability that is unlikely to be a top patching priority despite its network-exploitable nature. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, base 5.9) shows an unauthenticated network attacker can reach the flaw over HTTP, but AC:H signals that exploitation is difficult and requires specific conditions or timing beyond the attacker's control, which materially lowers real-world likelihood. Impact is confined to availability (A:H, complete DOS); there is no confidentiality or integrity loss, so this cannot be chained into data theft or code execution on its own. No EPSS score, CISA KEV listing, or public POC was provided in the input, and the vulnerability is not in CISA KEV - exploitation status is therefore 'no public exploit identified at time of analysis.' The combination of high attack complexity, availability-only impact, and absence of any exploitation signal places this well below critical RCE or data-breach flaws in the same Oracle advisory. No signals conflict; the main caveat is simply that AC:H plus Oracle's terse CPU wording leaves the exact triggering condition unspecified.

A remote, unauthenticated attacker sends specially crafted HTTP requests to an internet- or network-reachable Siebel CRM Deployment server infrastructure endpoint, triggering a condition that hangs or repeatedly crashes the service and produces a complete denial of service for CRM users. Because the CVSS vector marks high attack complexity (AC:H), the attacker must satisfy additional conditions - such as precise timing or a specific server state - so reliable exploitation is non-trivial. No public exploit code was identified at the time of analysis.