Oracle Siebel CRM CVE-2026-91437

Exploitation requires that the attacker already hold HIGH-privileged (administrative) access to the Siebel CRM Deployment product's Server Infrastructure component (CVSS PR:H), reachable over the network via HTTP. No user interaction is needed (UI:N). The key limiting factor is this pre-existing privilege requirement: this is not a remote-unauthenticated flaw, so realistic risk centers on malicious insiders or already-compromised administrative accounts. The scope change (S:C) means successful exploitation can impact additional connected Oracle products beyond Siebel CRM itself. Affected supported versions are 17.0 through 26.9.

Oracle's CVSS 3.1 base score is 8.7 (High) with vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N. The signals are mixed: the network vector (AV:N via HTTP) and low attack complexity (AC:L) favor exploitability, and the scope change (S:C) plus High confidentiality and integrity impact drive the score up, but the PR:H requirement is a significant mitigating factor - the attacker must already hold high-privileged (administrative) access to the Siebel CRM Deployment component before exploitation. There is NO EPSS score, NO CISA KEV listing, and NO public POC in the provided data, so there is no public exploit identified at time of analysis. This is a real but conditional priority: the high score reflects impact and scope rather than ease of initial access, and the PR:H gate means practical risk is largely confined to environments where a malicious or compromised privileged user is in play. NOTE A CONFLICT: the input Tags include 'Authentication Bypass,' which directly contradicts the CVSS PR:H (high-privilege required) metric and the description's explicit 'high privileged attacker' language - verify with Oracle, as the tag appears mislabeled. No CWE was assigned, limiting root-cause classification.

An attacker who has already obtained high-privileged credentials on an Oracle Siebel CRM Deployment server (e.g., a rogue administrator or an account compromised via separate means) sends crafted HTTP requests to the Server Infrastructure component. Because of the scope change, successful exploitation lets them read and modify critical data not only within Siebel CRM but across additional connected products. No public exploit code is identified, and no user interaction is required.