Oracle Siebel CRM CVE-2026-91444

Exploitation requires the attacker to possess a high-privileged logon account on the infrastructure/server where Siebel CRM Deployment executes (PR:H) and local access to that host (AV:L) - this is not remotely reachable and not exploitable by unauthenticated or low-privileged users. Affected: Siebel CRM Deployment versions 17.0 through 26.9, Server Infrastructure component. Limiting factors: the requirement for pre-existing high privileges and local logon drastically narrows the realistic threat to trusted insiders or attackers who have already escalated on the host; no user interaction is needed (UI:N) and attack complexity is low (AC:L) once those prerequisites are met. No specific optional feature or non-default configuration toggle is named in the description.

This is a moderate-severity issue (CVSS 3.1 base 6.7) whose real-world risk is substantially constrained by its exploitation prerequisites. The CVSS vector (AV:L/AC:L/PR:H/UI:N/S:U) shows that an attacker needs local logon to the infrastructure where Siebel CRM Deployment executes AND already-high privileges - this is the dominant risk-limiting factor and is why the score lands at 6.7 rather than critical despite full C:H/I:H/A:H impact. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active or probable exploitation; combined with PR:H/AV:L this points to a low-probability, insider- or post-compromise-escalation scenario rather than a mass-exploitable remote flaw. The only reference is the Oracle October 2026 Critical Patch Update advisory, consistent with a vendor-coordinated disclosure (reported by secalert_us@oracle.com) rather than observed in-the-wild activity. One minor conflict to verify: the input Tags label this 'Information Disclosure', yet the CVSS vector and description assert full takeover (C:H/I:H/A:H) - treat this as a confidentiality-AND-integrity-AND-availability compromise, not merely disclosure.

An attacker who already holds high-privileged local logon on a server hosting Siebel CRM Deployment (e.g., a malicious operator or an adversary who has already gained a privileged foothold) abuses a Server Infrastructure flaw to fully compromise and take over the Siebel CRM Deployment component. Exploitation is low-complexity (AC:L) and requires no user interaction, but is gated by the need for pre-existing high privileges and local access. No public exploit code was identified at time of analysis.