CVE-2026-91392

Analyzed Analyzed - Analysis Complete

Siebel CRM End User Unauthorized Data Modification

Publication date: 2026-10-20

Last updated on: 2026-11-04

Assigner: Oracle

Description

Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel CRM End User accessible data. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-11-04

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-91392

EUVD

EUVD-2026-106646

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	siebel_crm	From 17.0 (inc) to 26.9 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Siebel CRM End User (versions 17.0-26.9) affecting the Open UI component. It allows an unauthenticated attacker with network access via HTTP to potentially modify data in the Siebel CRM system. The impact is limited to unauthorized data changes (insert, update, or delete) but does not allow data viewing or system disruption.

Detection Guidance

Detection of this vulnerability requires monitoring for unauthorized data modifications in Oracle Siebel CRM End User. Check application logs for unusual HTTP requests targeting the Open UI component. Verify data integrity by comparing current records against known good backups. Ensure network traffic inspection tools are configured to flag suspicious HTTP activity to Siebel CRM endpoints.

Impact Analysis

If exploited, this vulnerability could allow an attacker to alter critical business data in your Siebel CRM system without authorization. This might include modifying customer records, financial data, or other sensitive information, potentially leading to incorrect business decisions or compliance violations.

Compliance Impact

This vulnerability could impact compliance by enabling unauthorized data modifications, which may violate integrity requirements in GDPR (data accuracy) and HIPAA (data integrity). Organizations using affected Siebel CRM versions should assess potential compliance risks and apply patches promptly.

Mitigation Strategies

Apply the latest Oracle Siebel CRM patches or updates for versions 17.0-26.9 to address the vulnerability in the Open UI component.

Hi! I’m here to help you understand CVE-2026-91392. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...