CVE-2026-91390

Status: ReceivedMedium (5.4)—

Severity5.4Medium · CVSS 3.1

Exploitation probability—next 30 days

Active exploitationNonot in the CISA catalog

Public exploitNot knownno public code found

Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel CRM End User, attacks may significantly impact additional products (scope change).

Read full descriptionShow less

Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel CRM End User accessible data as well as unauthorized read access to a subset of Siebel CRM End User accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).

CVSS

Base score: 5.4
Version: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitation probability (EPSS)

FIRST hasn't scored this CVE yet (usual for very recent or rejected CVEs).

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1203 Exploitation for Client Executionexecution85 %
Primary impactT1565 Data Manipulationimpact80 %
Secondary impactT1213 Data from Information Repositoriescollection65 %

El vector UI:R exige interacción de otro usuario, por lo que es ejecución en el cliente (T1203). El texto cita modificación/borrado no autorizado y lectura parcial de datos del CRM.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

ATT&CK mitigations that cover these techniques

Encrypt Sensitive Information User Training User Account Management Restrict File and Directory Permissions Remote Data Storage Network Segmentation

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Oracle — Siebel CRM END User^AI

References

Show 1 references

https://www.oracle.com/security-alerts/cpuoct2026.html

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-91390",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "secalert_us@oracle.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "secalert_us@oracle.com",
      "affectedData": [
        {
          "vendor": "Oracle Corporation",
          "product": "Siebel CRM End User",
          "versions": [
            {
              "status": "affected",
              "version": "17.0",
              "versionType": "custom",
              "lessThanOrEqual": "26.9"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-20T22:20:42.273",
  "references": [
    {
      "url": "https://www.oracle.com/security-alerts/cpuoct2026.html",
      "source": "secalert_us@oracle.com"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM End User.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel CRM End User, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel CRM End User accessible data as well as  unauthorized read access to a subset of Siebel CRM End User accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)."
    }
  ],
  "lastModified": "2026-10-20T22:20:42.273",
  "sourceIdentifier": "secalert_us@oracle.com"
}