CVE-2026-91372

Analyzed Analyzed - Analysis Complete

Siebel CRM Cloud Applications Information Disclosure Vulnerability

Publication date: 2026-10-20

Last updated on: 2026-11-04

Assigner: Oracle

Description

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 3.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-11-04

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-91372

EUVD

EUVD-2026-106626

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	siebel_crm	From 22.3 (inc) to 26.9 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Siebel CRM Cloud Applications (versions 22.3-26.9) where a low-privileged attacker with system access can exploit it to gain unauthorized read access to some application data. The CVSS score is 3.3, indicating a low severity with confidentiality impact only.

Detection Guidance

This vulnerability requires low-privilege access to the infrastructure hosting Siebel CRM Cloud Applications. Detection involves monitoring for unauthorized read access to sensitive data within the application. Check Siebel Cloud Manager logs for unusual queries or data access patterns. Ensure all user accounts follow least privilege principles and review audit logs regularly for anomalies.

Impact Analysis

If exploited, an attacker could read a subset of sensitive data within Siebel CRM Cloud Applications. This may include customer information, business data, or other confidential records accessible to the application.

Compliance Impact

This vulnerability allows unauthorized read access to a subset of Siebel CRM Cloud Applications data, which could lead to exposure of sensitive personal or health information. This may impact compliance with GDPR (data protection) and HIPAA (health data privacy) if such data is compromised.

Mitigation Strategies

Apply the latest Oracle Siebel CRM Cloud Applications patches for versions 22.3-26.9. Restrict user privileges to minimize access. Monitor logs for suspicious activity related to data access.

Hi! I’m here to help you understand CVE-2026-91372. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...