Oracle Siebel CRM CVE-2026-91431

Exploitation requires the attacker to already have an authenticated low-privileged account with logon access to the infrastructure where Siebel CRM End User runs (per PR:L and the description's explicit 'logon to the infrastructure' wording), and the affected Open UI component must be in use on a version in the 17.0-26.9 range. Limiting factors: the attack vector is LOCAL (AV:L) - not exploitable remotely over a network - and valid credentials are mandatory, so purely external, unauthenticated attackers cannot leverage it directly; impact is confined to reading data (no integrity or availability effect).

This is a moderate-severity, confidentiality-only issue (CVSS 3.1 base 5.5) that is unlikely to be a top-tier emergency. The vendor-supplied vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicates LOCAL attack vector requiring an already-authenticated low-privileged account (PR:L) with logon to the infrastructure where Siebel CRM End User executes - this is not remotely exploitable from the internet and not an unauthenticated flaw. Impact is limited to confidentiality (C:H, I:N, A:N): an attacker could read critical or all Siebel-accessible data but cannot modify data or disrupt availability. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active exploitation or weaponization - this appears to be a routine Oracle Critical Patch Update item rather than an urgent threat. A key data conflict exists: the input Tags include 'Authentication Bypass', yet both the description ('low privileged attacker with logon') and the CVSS vector (PR:L) require valid authentication, so the 'Authentication Bypass' label contradicts the authoritative Oracle data and appears mislabeled - verify against the Oracle advisory. CWE is N/A, limiting precise weakness classification.

An attacker who already holds a low-privileged, authenticated Siebel CRM End User account (or local logon to the hosting infrastructure) abuses a flaw in the Open UI component to read Siebel data beyond their authorization level. Because the attack is local and low-complexity (AV:L/AC:L) but requires existing credentials, the most realistic actor is a malicious insider or someone who has already obtained a foothold. No public exploit code is identified at time of analysis.