Oracle Siebel CRM CVE-2026-91441

Exploitation requires an authenticated low-privileged account (PR:L) on Oracle Siebel Customer Order Management reachable over HTTP, AND human interaction from a different user (UI:R) - typically a victim viewing attacker-supplied content in the Order Management component. These two factors are the primary limiters: the attacker cannot act fully unauthenticated, and the attack does not complete until a separate (often higher-privileged) user interacts with the malicious data. Affected deployments run Siebel CRM versions 17.0 through 26.9; environments patched via Oracle CPU October 2026 are not exposed. The scope change (S:C) means successful exploitation may extend impact to additional products beyond Siebel COM itself.

This is a medium-severity (CVSS 6.5) vulnerability whose signals point to a bounded, conditionally-exploitable issue rather than an urgent priority. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) describes a network-reachable, low-complexity flaw that nonetheless requires BOTH low-level authentication (PR:L) AND human interaction from a victim other than the attacker (UI:R). The scope change (S:C) combined with UI:R, low privileges, and uniformly Low C/I/A impacts is the classic fingerprint of a stored/reflected cross-site scripting or similar injection flaw in a web application, though Oracle does not disclose a CWE (CWE: N/A), so the vulnerability class is INFERRED, not confirmed. No EPSS score is provided in the input, this CVE is NOT on the CISA KEV list, and no public exploit is referenced - so there is no public exploit identified at time of analysis. The 'Denial Of Service' tag is consistent with the description's partial-DOS language (A:L). The practical takeaway: the combination of required authentication and required victim interaction meaningfully limits mass exploitation, so this ranks below internet-facing unauthenticated flaws, but the scope change (impact spilling to additional products) and low attack complexity justify patching in the normal Oracle quarterly cycle. Note that no independent EPSS/KEV data was supplied, so exploitation-probability cannot be quantitatively compared - treat this assessment as based solely on the CVSS vector and Oracle's description.

A low-privileged authenticated user of Oracle Siebel Customer Order Management injects crafted content (e.g., into an order-management field rendered in another user's browser). When a higher-privileged employee or administrator subsequently views that data (the required human interaction), the payload executes in their session, enabling limited data read/modification and crossing a trust boundary into additional products. No public exploit code is known at the time of analysis.