CVE-2026-91424

Oracle Siebel Crm: access control flaw can lead to denial of service

Risk score: 40/100
CVSS: 6.4 v3.1
Exploit chance (30 days): 0.2%
Published: 20 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful attacks of this …
Affected: Oracle Siebel Crm
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Oracle Siebel Crm: Amber, patch this week. A critical vulnerability in Oracle Siebel CRM's Siebel Cloud Manager component allows a low-privileged attacker to compromise Siebel CRM Cloud Applications via HTTP, potentially leading to takeover of the application.

The flaws

CVE-2026-91424: Access control flaw can lead to denial of service (CVSS 6.4 · EPSS 0%)
CVE-2026-101446: Improper input validation (CVSS 9.9 · EPSS 0%)
CVE-2026-101495: Cross-site request forgery (CVSS 8.8 · EPSS 0%)
CVE-2026-101458: Access control flaw (CVSS 8.2 · EPSS 0%)

The fix

Fix: Check the linked advisory for a fix, as none is provided.

Who is exposed: {'products': ['Oracle Siebel CRM'], 'packages': [], 'versions': ['17.0-26.9']}

Where it stands

No known exploitation

Connects to

Same weakness: Access control flaw (CWE-284). 398 other warnings in 30 days
Same product: Earlier Oracle Siebel Crm warnings. 85 in the last 90 days

Why it is Yellow

CVSS 6.4 medium

References

https://www.oracle.com/security-alerts/cpuoct2026.html

Original description

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel CRM Deployment as well as unauthorized update, insert or delete access to some of Siebel CRM Deployment accessible data and unauthorized read access to a subset of Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H).

Last activity 20 Oct 2026. Patch Forecast updates every hour.