Siebel CRM Deployment CVE-2026-91424

Exploitation requires (1) network access to the Siebel CRM Deployment's Server Infrastructure component over HTTP, and (2) a valid low-privilege Siebel account (PR:L) - this is not unauthenticated. The High attack complexity (AC:H) indicates a further limiting condition the attacker does not fully control, such as a race/timing window or a specific server state that must coincide; this is the primary factor reducing real-world exploitability. Affected deployments are Oracle Siebel CRM 'Siebel CRM Deployment' versions 17.0 through 26.9. Realistic risk is highest where the Siebel server is internet- or widely-network-exposed and low-privilege accounts are liberally provisioned; it is substantially limited in environments where Siebel is restricted to an internal network and account issuance is tightly controlled. No end-user interaction is required (UI:N).

This is a moderate-severity, moderate-priority issue, not a top-tier emergency. The CVSS 3.1 base score of 6.4 (vector AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H) reflects a network-reachable flaw over HTTP, but two factors materially temper real-world risk: Attack Complexity is High (AC:H), meaning the attacker must win a race, meet timing constraints, or satisfy conditions outside their control, and Privileges Required is Low (PR:L), meaning a valid low-privilege Siebel account is a precondition. The dominant impact is Availability (A:H - complete, repeatable DoS/crash of the Siebel CRM Deployment), with only partial Confidentiality and Integrity impact (C:L/I:L - read of a subset of data and unauthorized insert/update/delete of some data). No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no signal of active or imminent exploitation - exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. In short: the high CVSS-ish severity is driven by the complete-DoS availability impact, but the AC:H + PR:L gate makes opportunistic mass exploitation unlikely; this is a patch-in-normal-cycle item for Siebel operators rather than a drop-everything event, with priority rising for internet-exposed Siebel instances where low-privilege accounts are broadly provisioned.

An authenticated low-privilege user (or an attacker who has phished/obtained such credentials) sends specially crafted HTTP requests to the Siebel Server Infrastructure component, exploiting a timing- or condition-dependent flaw (AC:H) to crash the deployment and/or tamper with a subset of accessible data. Because the service can be driven into a hang or repeatable crash, the attacker achieves a complete denial of service against the CRM platform. No public exploit code was identified at the time of analysis, and the High attack complexity means success is not guaranteed on a single attempt.