Siebel CRM Deployment CVE-2026-91423

Exploitation requires the attacker to already have high-privileged logon access (PR:H) to the infrastructure host where the Siebel CRM Deployment Server Infrastructure component executes; the attack vector is strictly local (AV:L), so it is not reachable over the network and not exploitable against a default remote-facing configuration. No user interaction is needed (UI:N) and attack complexity is low (AC:L) once that privileged local foothold exists. Limiting factors: the dual requirements of local access plus pre-existing high privilege confine realistic exploitation to malicious insiders or attackers who have already compromised a privileged account on the Siebel host, and only Siebel CRM Deployment versions 17.0 through 26.9 are affected.

This is a moderate-severity, lower-priority issue despite the C:H/I:H impacts. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U) scores 6.0 and is the controlling signal: exploitation requires LOCAL access (AV:L) AND already-high privileges (PR:H) on the host where Siebel CRM Deployment executes, which substantially gates real-world abuse. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT in CISA KEV and no POC is referenced, so there is no evidence of active exploitation or public exploit code. SSVC-style reasoning: exploitation=none observed, automatable=no (requires authenticated local privileged context, not internet-reachable), technical impact=partial-to-total on confidentiality/integrity but zero availability (A:N). CONFLICT TO NOTE: the 'Authentication Bypass' tag directly contradicts the CVSS PR:H metric - a genuine authentication bypass would be PR:N, so the tag appears mislabeled and should not drive prioritization. Net: a high-privilege insider or an attacker who has already compromised a privileged account on the Siebel host could escalate access to critical data, but this is not a remotely weaponizable, mass-exploitable flaw. Treat as part of routine Oracle CPU patching, not an emergency.

An attacker who has already obtained high-privilege logon access to the server hosting Siebel CRM Deployment (e.g., a malicious administrator or an actor who compromised a privileged service account) abuses the Server Infrastructure component to read, modify, or delete critical Siebel data beyond their intended authorization. No user interaction is required. No public exploit code is referenced, so exploitation would require custom tooling against the local infrastructure.