Oracle Siebel CRM CVE-2026-91447

No special conditions - remote unauthenticated exploitation over HTTP against default configurations of Oracle Siebel CRM (Server Infrastructure component) in supported versions 17.0 through 26.9. The attacker needs only network access to the Siebel CRM Deployment HTTP interface. The primary limiting factor is impact scope: the flaw affects confidentiality only (C:H, I:N, A:N), so it enables data disclosure rather than modification, denial of service, or code execution; exposure is further limited to deployments whose Siebel HTTP endpoint is reachable from the attacker's network position.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) is internally consistent and describes a network-reachable, low-complexity, unauthenticated flaw with no user interaction that yields high confidentiality impact but zero integrity or availability impact - i.e., pure unauthorized data disclosure, not code execution or system takeover. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so there is no evidence of active exploitation or weaponization; the SSVC exploitation state is best characterized as 'none' at time of analysis. The signals therefore partially conflict with the raw severity: the metrics make this trivially exploitable in principle (no auth, network HTTP, default config), yet the absence of any exploitation-maturity signal means it is not demonstrably an imminent, in-the-wild priority. Note that the 'Authentication Bypass' tag overstates the mechanism - the CVSS and description describe unauthenticated information disclosure, not a true auth-bypass granting privileged control; treat that tag with caution. For organizations running Oracle Siebel CRM exposed to untrusted networks this warrants prompt patching in the normal Oracle CPU cycle, but the lack of integrity/availability impact and absence of known exploitation place it below critical RCE-class issues.

A remote, unauthenticated attacker who can reach a Siebel CRM Deployment server over HTTP sends a crafted request to the Server Infrastructure component and receives back confidential CRM data they should not be able to access. Because the CVSS specifies AC:L, PR:N and UI:N, no special timing, credentials, or victim interaction is required. No public exploit code was identified in the provided intelligence.