Oracle Siebel CRM CVE-2026-91445

Exploitation requires network access to the HTTP interface of a Siebel CRM End User instance, specifically targeting the Communications Panel/Dashboard component, on any supported version in the 17.0 through 26.9 range. Per CVSS PR:N/UI:N, no credentials and no victim interaction are needed, so default internet- or intranet-exposed deployments are at risk. The primary limiting factors are network reachability of the Siebel web tier (instances restricted to internal networks or behind a WAF/VPN are far less exposed) and whether the affected Communications Panel/Dashboard component is deployed and enabled; integrity impact is limited (I:L) and there is no availability impact, so this is predominantly a data-confidentiality exposure with partial write capability.

This is a genuine priority for organizations running Oracle Siebel CRM, though the signals are mixed. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes the worst-case exposure profile: remotely reachable over HTTP, low attack complexity, no privileges, and no user interaction required - Oracle's own text reinforces this by calling it 'easily exploitable.' The 8.2 base score is driven by high confidentiality impact (C:H, full read access to Siebel End User accessible data) plus limited integrity impact (I:L, some insert/update/delete), with no availability impact (A:N). Against this high theoretical exposure, the real-world exploitation signals are weak or absent: there is no CISA KEV listing, no public proof-of-concept referenced, and no EPSS score was provided in the input, so near-term mass-exploitation probability cannot be quantified. The only reference is the Oracle October 2026 Critical Patch Update advisory, consistent with a vendor-coordinated disclosure (reporter secalert_us@oracle.com) rather than observed in-the-wild activity. CONFLICT TO VERIFY: the input Tags include 'Authentication Bypass,' but neither the description nor the CVSS vector confirms a bypass mechanism - the description only states the attacker is unauthenticated (PR:N), which is not the same as bypassing an existing authentication control; treat the 'Authentication Bypass' characterization as unconfirmed pending the Oracle CPU detail. Net: high-severity, pre-auth, network-facing data-exposure flaw in enterprise CRM that warrants prompt patching, but currently lacking evidence of active or automated exploitation.

An unauthenticated attacker who can reach a Siebel CRM End User instance over HTTP sends crafted requests to the Communications Panel/Dashboard component and retrieves sensitive Siebel data without logging in, then performs a limited set of unauthorized inserts, updates, or deletes. Because no privileges, user interaction, or special timing are required (AC:L), exploitation is straightforward against any exposed instance. No public proof-of-concept is identified at time of analysis, so this scenario is derived from the CVSS vector and Oracle's description rather than a demonstrated exploit.