Siebel CRM Deployment CVE-2026-91436

Exploitation requires the attacker to already have high-privileged logon access (PR:H) to the infrastructure host where Siebel CRM Deployment (Server Infrastructure component) executes - this is not a remote or network-reachable flaw (AV:L). Additionally, AC:H indicates the attack depends on difficult, attacker-uncontrolled conditions being met, further limiting practical exploitation. Affected deployments are Oracle Siebel CRM Deployment versions 17.0 through 26.9. The flaw cannot be triggered by an unauthenticated or low-privileged remote actor; realistic exploitation is confined to privileged local operators or an adversary who has already fully compromised a privileged account on that host. No user interaction is required (UI:N).

This is a low-severity, low-real-world-risk issue despite being tracked as a CVE. The CVSS 3.1 base score is 3.9 (Low), and every exploitability metric points away from easy attack: AV:L requires local logon access to the host running Siebel CRM Deployment, AC:H indicates conditions outside the attacker's control must be met, and PR:H means the attacker must already hold high privileges on that infrastructure. Impacts are uniformly partial (C:L/I:L/A:L) with no scope change (S:U). No EPSS score, SSVC decision, KEV listing, or POC was provided in the input; absence of these is consistent with a quietly-patched Oracle Critical Patch Update item rather than an actively targeted flaw. The 'Denial Of Service' tag aligns with the partial A:L impact but should not be read as a remote crash primitive - the DoS is partial and requires prior high-privileged local access. Net: this is a defense-in-depth hardening fix for already-privileged insiders/compromised accounts, not an urgent remediation priority. No key signals conflict with the CVSS vector.

An attacker who already has high-privileged logon access to the server hosting Siebel CRM Deployment (e.g. a malicious insider or an adversary who has compromised a privileged operations account) leverages that position to meet the difficult (AC:H) exploitation conditions and partially read, modify, or disrupt Siebel CRM Deployment data. No public exploit code is identified, and success depends on pre-existing privileged local access rather than any remote entry point.