CVE-2026-91363

Analyzed Analyzed - Analysis Complete

Information Disclosure in Siebel CRM Cloud Applications

Publication date: 2026-10-20

Last updated on: 2026-11-04

Assigner: Oracle

Description

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-11-04

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-91363

EUVD

EUVD-2026-106617

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	siebel_crm	From 22.3 (inc) to 26.9 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability affects Oracle Siebel CRM Cloud Applications versions 22.3 to 26.9. It allows an unauthenticated attacker with network access via HTTP to potentially read a subset of data in the application. The attack is difficult to perform and has a low impact on confidentiality.

Detection Guidance

Detection of this vulnerability requires monitoring network traffic for unauthorized access attempts to Siebel CRM Cloud Applications via HTTP. Check server logs for unusual requests targeting the Siebel Cloud Manager component. Ensure intrusion detection systems are configured to alert on suspicious activity related to this component.

Impact Analysis

An attacker could exploit this to gain unauthorized read access to some data in your Siebel CRM Cloud Applications. This might include sensitive information depending on what data is stored in the affected subset.

Compliance Impact

This vulnerability allows unauthorized read access to a subset of Siebel CRM Cloud Applications data, which could lead to exposure of sensitive personal or health information. This may violate GDPR if personal data is involved or HIPAA if protected health information is compromised.

Mitigation Strategies

Apply the latest security patches from Oracle for Siebel CRM Cloud Applications versions 22.3-26.9. Restrict network access to the Siebel Cloud Manager component via firewalls or network segmentation. Monitor for unauthorized read access to sensitive data and review access logs regularly.

Hi! I’m here to help you understand CVE-2026-91363. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...