Oracle Siebel CRM CVE-2026-91426

Requires a local logon account on the infrastructure host where the Siebel CRM Deployment 'Server Infrastructure' component executes (AV:L, PR:L); the account need only be low-privileged and no user interaction is required (UI:N). Exploitation is limited to Siebel CRM Deployment versions 17.0 through 26.9 and yields only read access to confidential data (C:H, I:N, A:N) - there is no remote/network path and no integrity or availability impact. The practical limiting factor is that an attacker must already have authenticated local/logon access to the Siebel server infrastructure, which excludes purely external unauthenticated attackers.

This is a moderate-severity, confidentiality-only issue (CVSS 3.1 base 5.5) whose real-world risk is tempered by its local attack vector. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms the attacker must already have a low-privileged logon to the infrastructure where Siebel CRM Deployment executes - this is not a remotely exploitable flaw. Exploitation is low-complexity and requires no user interaction, so any user with a foothold could reliably read critical Siebel data (full confidentiality impact, no integrity or availability impact). No EPSS score, CISA KEV listing, POC, or SSVC data was provided in the input; absence of these signals means there is no public evidence of active exploitation or automatable mass exploitation. The 'Authentication Bypass' tag conflicts with the CVSS vector, which explicitly requires PR:L (an authenticated low-privileged account) - this flaw is a privilege-boundary/information-disclosure issue, not an authentication bypass, and the tag appears mislabeled. Net: a real but contained priority - patch in normal Oracle CPU cadence, prioritized for environments where many low-trust users share Siebel infrastructure, rather than an emergency internet-facing exposure.

A low-privileged user who already has an interactive or service logon on the host running Siebel CRM Deployment leverages the Server Infrastructure flaw to read confidential CRM data they should not be able to access. No user interaction or elevated privileges are needed and attack complexity is low, but the attacker must first obtain local/logon access to the infrastructure. No public exploit code was identified in the provided data.