Oracle Siebel CRM CVE-2026-91432

Exploitation requires network HTTP access to the Siebel CRM End User Open UI interface on an affected deployment running versions 17.0 through 26.9; no authentication, elevated privileges, or user interaction is needed (AV:N/PR:N/UI:N/AC:L), so default, reachable Open UI endpoints are exposed. The primary limiting factor is network reachability of the Open UI endpoint - organizations that restrict the Siebel End User interface to internal networks or behind VPN/WAF substantially reduce exposure - and impact is inherently bounded to a subset of accessible data (partial confidentiality and integrity, no availability/denial-of-service effect). Oracle does not publish the specific Open UI function or request type required, so the precise triggering feature cannot be confirmed from available data.

This is a moderate-priority, broadly-exploitable-but-limited-impact issue rather than a critical emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) is favorable to attackers: network-reachable over HTTP, low attack complexity, no privileges, and no user interaction, meaning any attacker who can reach a Siebel CRM End User (Open UI) endpoint can attempt exploitation. However, impact is deliberately scoped as partial - C:L/I:L/A:N - yielding only partial read access to a subset of data and partial unauthorized update/insert/delete to some data, with no availability impact and no scope change (S:U). No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization; this is a vendor-disclosed (Oracle CPU) issue with no public exploit identified at time of analysis. One conflict to verify: the input Tags include 'Authentication Bypass,' but the description and CVSS merely reflect an unauthenticated flaw (PR:N) with partial CIA impact and does not describe bypassing an authentication control - treat the 'Authentication Bypass' characterization as unverified against the description. Net: prioritize for scheduled patching via the October 2026 Oracle CPU, but it does not carry the signals of an actively exploited emergency.

An unauthenticated attacker who can reach the internet-facing or intranet-facing Siebel CRM End User (Open UI) interface sends crafted HTTP requests to the vulnerable component. Because no authentication, privileges, or user interaction are required and complexity is low, the attacker gains unauthorized read of a subset of CRM data and can perform limited unauthorized insert/update/delete operations. No public exploit code is identified in the provided data, so exploitation would require an attacker to independently develop the request.