Oracle Siebel CRM CVE-2026-91422

Exploitation requires a valid low-privileged, authenticated account on the targeted Siebel CRM Deployment instance (PR:L), network access to the Server Infrastructure component over HTTP (AV:N), and satisfaction of the non-trivial conditions implied by high attack complexity (AC:H) - such as specific timing, server state, or configuration that the attacker cannot reliably control on demand. No end-user interaction is needed (UI:N). The exploit is confined to Siebel CRM Deployment versions 17.0 through 26.9 and affects integrity only; it cannot be used to read confidential data or disrupt availability. These factors - required authentication and high complexity - substantially limit realistic exploitation to actors who already have footholds in the CRM environment.

This is a moderate-severity integrity flaw (CVSS 3.1 base 5.3) whose real-world risk is tempered by two significant friction factors in the vendor-supplied vector: AC:H (high attack complexity, meaning the attacker must win a race, meet special conditions, or overcome non-trivial preparation) and PR:L (the attacker must already hold a low-privileged, authenticated Siebel account). The vector is network-reachable over HTTP (AV:N) with no user interaction (UI:N) and an unchanged scope (S:U). Impact is integrity-only (C:N/I:H/A:N) - attackers can create, delete, or modify critical Siebel CRM Deployment data, but cannot read confidential data or cause denial of service. No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the intelligence set, so there is no public exploit identified at time of analysis and no signal of active exploitation or automatable mass-scanning. Weighing these signals together, this is a genuine but not emergency-priority issue: the combination of AC:H and the authentication requirement makes opportunistic widespread exploitation unlikely, and it is best handled on a normal patch cadence (Oracle October 2026 CPU) rather than as a drop-everything fire. NOTE A CONFLICT: the input Tags label this 'Authentication Bypass,' yet the CVSS vector requires PR:L (an authenticated attacker) and reports only integrity impact - an authentication-bypass characterization is inconsistent with the vendor vector and should be verified, as the description describes a privileged data-manipulation flaw, not a bypass of authentication.

An attacker who has already obtained low-privileged credentials to a Siebel CRM Deployment instance sends crafted HTTP requests to the Server Infrastructure component and, after meeting the specific timing or state conditions implied by the high attack complexity, manipulates data they should not be able to alter. The result is unauthorized creation, deletion, or modification of critical Siebel CRM data without any effect on confidentiality or availability. No public proof-of-concept exploit was identified in the provided data.