Siebel CRM Deployment CVE-2026-91440

The affected component is the Siebel CRM Deployment 'Server Infrastructure' in Oracle Siebel CRM versions 17.0 through 26.9, reachable via HTTP. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), there are no special preconditions - a remote, unauthenticated attacker can exploit default network-facing deployments without credentials or user interaction. The practical limiting factor is network reachability: exploitation requires HTTP access to the Siebel server, so instances restricted to internal networks or behind access controls present a materially smaller attack surface than internet-exposed deployments. Impact is also inherently limited to a subset of accessible data (partial read and partial write/delete), not full system compromise.

This is a moderate, real-but-not-emergency priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) is favorable to an attacker - network-reachable over HTTP, low complexity, no authentication, and no user interaction - which is why the base score lands at 6.5 rather than lower. However, impact is deliberately constrained: Confidentiality and Integrity are both rated Low (C:L/I:L) and Availability is None, meaning read access only to a subset of data and write/update/delete to only some data, with no scope change (S:U). No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or imminent exploitation. The signals are internally consistent: an easy-to-reach but limited-impact flaw disclosed through Oracle's quarterly Critical Patch Update process rather than in response to in-the-wild attacks. Net: patch in the normal Oracle CPU cycle and prioritize if Siebel is internet-exposed, but this is not a drop-everything issue. Note the 'Authentication Bypass' tag is not independently corroborated by the description, which states unauthenticated access but does not explicitly describe bypassing an authentication control - treat that characterization with caution.

An unauthenticated attacker with network access to a Siebel CRM Deployment server sends crafted HTTP requests to the vulnerable Server Infrastructure component and obtains read access to a subset of application data and the ability to update, insert, or delete some records. No public exploit code was identified at the time of analysis, and exploitation requires no credentials or user interaction, so an internet-exposed instance is the main risk surface.