CVE-2026-91362

Analyzed Analyzed - Analysis Complete

Siebel CRM Cloud Applications Information Disclosure Vulnerability

Publication date: 2026-10-20

Last updated on: 2026-11-04

Assigner: Oracle

Description

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-11-04

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-91362

EUVD

EUVD-2026-106616

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	siebel_crm	From 22.3 (inc) to 26.9 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Siebel CRM Cloud Applications affecting versions 22.3 to 26.9. It allows an unauthenticated attacker with network access via HTTP to read a subset of data in the application. The impact is limited to unauthorized read access without affecting integrity or availability.

Detection Guidance

This vulnerability allows unauthenticated network access via HTTP to compromise Siebel CRM Cloud Applications. Detection may involve monitoring HTTP traffic for unusual access patterns or unauthorized data requests to Siebel CRM endpoints. Check server logs for unexpected HTTP requests targeting the Siebel Cloud Manager component.

Impact Analysis

If you use Oracle Siebel CRM Cloud Applications versions 22.3 to 26.9, an attacker could access sensitive data without authentication. This may lead to data breaches, loss of confidential information, or compliance violations depending on the exposed data.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations may face fines or penalties if such breaches occur due to inadequate security measures.

Mitigation Strategies

Apply the latest security patches from Oracle for Siebel CRM Cloud Applications versions 22.3-26.9. Ensure network access to the component is restricted and monitor for unauthorized HTTP access attempts.

Hi! I’m here to help you understand CVE-2026-91362. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...