CVE-2026-91433

Analyzed Analyzed - Analysis Complete

Authentication Bypass in Siebel Apps - Field Service

Publication date: 2026-10-20

Last updated on: 2026-11-04

Assigner: Oracle

Description

Vulnerability in the Siebel Apps - Field Service product of Oracle Siebel CRM (component: Smart Answer). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Siebel Apps - Field Service. Successful attacks of this vulnerability can result in takeover of Siebel Apps - Field Service. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-11-04

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-91433

EUVD

EUVD-2026-106683

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	siebel_crm	From 17.0 (inc) to 26.9 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Siebel CRM's Siebel Apps - Field Service product, specifically in the Smart Answer component. It affects versions 17.0 to 26.9. The issue allows a high-privileged attacker with network access via HTTP to take over the system.

Impact Analysis

An attacker could exploit this to gain full control of the Siebel Apps - Field Service system, potentially leading to unauthorized access, data theft, or system disruption. The high CVSS score indicates significant risk.

Compliance Impact

This vulnerability allows high privileged attackers to compromise Siebel Apps - Field Service, potentially leading to unauthorized access, data breaches, or system takeover. Such breaches could violate GDPR by exposing personal data or HIPAA by compromising protected health information, depending on the data processed by the system.

Mitigation Strategies

Apply the latest security patches from Oracle for Siebel Apps - Field Service versions 17.0-26.9. Restrict network access to the HTTP interface and limit privileges for users accessing the system.

Hi! I’m here to help you understand CVE-2026-91433. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...