Oracle Siebel CRM Deployment: Privilege escalation in Server Infrastructure
Summary
A vulnerability in the Server Infrastructure component of Oracle Siebel CRM Deployment, versions 17.0 through 26.9, allows an attacker with high privileges and network access via HTTP to compromise the product. The CVSS scope is changed, so an attacker could also affect other products beyond Siebel. Successful attacks can lead to unauthorized creation, deletion or modification of data, and unauthorized read access to critical data; availability is not affected according to the CVSS vector.
Affected
- Oracle Siebel CRM Deployment 17.0 through 26.9 (Server Infrastructure component)
- Note: a Tenable detection title mentions "<= 26.8", which conflicts with the vendor range; verify with Oracle.
Fixed in
Unknown. Check the Oracle October 2026 Critical Patch Update advisory for the Siebel CRM Deployment patch and fixed build.
Workaround
- No vendor workaround found.
- Limit which accounts can reach the Siebel HTTP interface until the patch is applied.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Not listed in CISA KEV.
- No public proof-of-concept found in research; this does not prove none exists.
Our recommendation
- Check whether any Siebel CRM Deployment instances are reachable from the internet.
- Review which accounts hold administrator rights and reduce them to the necessary minimum.
- Apply the Oracle October 2026 Critical Patch Update for Siebel CRM Deployment once the fixed build is confirmed, together with CVE-2026-59083 (Apache Tomcat).
- Monitor for public exploit code or KEV listing.
- Recheck the NVD record, as its status may have changed since publication.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update Advisory October 2026 www.oracle.com
- Vulners CVE-2026-91437 vulners.com
- OpenCVE CVE-2026-91437 app.opencve.io
- Vulners Oracle CPUOCT2026 mirror vulners.com
- Tenable: Oracle October 2026 CPU www.tenable.com
- HivePro: Oracle October 2026 CPU www.hivepro.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:14.
Original description (NVD)
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Siebel CRM Deployment. While the vulnerability is in Siebel CRM Deployment, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.