CVE-2026-91392
Received Received - Intake

Siebel CRM End User Unauthorized Data Modification

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: Oracle

Description
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel CRM End User accessible data. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-21
AI Q&A
2026-10-21
EPSS Evaluated
N/A
NVD
CVE-2026-91392

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Oracle Corporation Siebel CRM End User 17.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a vulnerability in Oracle Siebel CRM End User (versions 17.0-26.9) affecting the Open UI component. It allows an unauthenticated attacker with network access via HTTP to potentially modify data in the Siebel CRM system. The impact is limited to unauthorized data changes (insert, update, or delete) but does not allow data viewing or system disruption.

Impact Analysis

If exploited, this vulnerability could allow an attacker to alter critical business data in your Siebel CRM system without authorization. This might include modifying customer records, financial data, or other sensitive information, potentially leading to incorrect business decisions or compliance violations.

Compliance Impact

This vulnerability could impact compliance by enabling unauthorized data modifications, which may violate integrity requirements in GDPR (data accuracy) and HIPAA (data integrity). Organizations using affected Siebel CRM versions should assess potential compliance risks and apply patches promptly.

Mitigation Strategies

Apply the latest Oracle Siebel CRM patches or updates for versions 17.0-26.9 to address the vulnerability in the Open UI component.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91392. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart