{
  "cve": "CVE-2026-91420",
  "enrichment": {
    "affected": [
      {
        "configurations": [
          {
            "platform": null,
            "status": "affected",
            "versions": {
              "scheme": "generic",
              "value": "[17.0,26.9]"
            }
          }
        ],
        "enrichment": {
          "confidence": 100.0,
          "confidence_source": "matching",
          "scores": [
            {
              "score": 100.0,
              "source": "matching"
            }
          ]
        },
        "original": {
          "product": "Siebel CRM Deployment",
          "source": "cna",
          "vendor": "Oracle Corporation"
        },
        "product": "siebel_crm_deployment",
        "vendor": "oracle"
      }
    ],
    "created": "2026-10-21T10:15:14.509454+00:00",
    "title": "Unauthorized Data Modification via Low-Privilege HTTP Access in Siebel CRM Deployment",
    "updated": "2026-10-23T22:45:14.481828+00:00",
    "vendors": [
      "oracle",
      "oracle$PRODUCT$siebel_crm_deployment"
    ],
    "weaknesses": [
      "CWE-284"
    ]
  },
  "epss": {
    "score": 0.00234
  },
  "mitre": {
    "cpes": [
      "cpe:2.3:a:oracle:siebel_crm_deployment:*:*:*:*:*:*:*:*"
    ],
    "created": "2026-10-20T21:25:52.406000+00:00",
    "description": "Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 6.5,
        "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
      },
      "cvssV4_0": {}
    },
    "mitre_repo_path": "cves/2026/91xxx/CVE-2026-91420.json",
    "references": [
      "https://www.oracle.com/security-alerts/cpuoct2026.html"
    ],
    "title": null,
    "updated": "2026-10-23T20:05:57.102000+00:00",
    "vendors": [
      "oracle",
      "oracle$PRODUCT$siebel_crm_deployment"
    ],
    "weaknesses": []
  },
  "nvd": {
    "cpes": [
      "cpe:2.3:a:oracle:siebel_crm:*:*:*:*:*:*:*:*"
    ],
    "created": "2026-10-20T22:20:45.420000+00:00",
    "description": "Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 6.5,
        "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
      },
      "cvssV4_0": {}
    },
    "nvd_repo_path": "2026/CVE-2026-91420.json",
    "references": [
      "https://www.oracle.com/security-alerts/cpuoct2026.html"
    ],
    "title": null,
    "updated": "2026-11-04T15:53:35.110000+00:00",
    "vendors": [
      "oracle",
      "oracle$PRODUCT$siebel_crm"
    ],
    "weaknesses": [
      "CWE-284"
    ]
  },
  "opencve": {
    "changes": [
      {
        "created": "2026-10-20T21:30:00+00:00",
        "data": [
          {
            "details": {
              "new": "Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).",
              "old": null
            },
            "type": "description"
          },
          {
            "details": [
              "oracle",
              "oracle$PRODUCT$siebel_crm_deployment"
            ],
            "type": "first_time"
          },
          {
            "details": {
              "added": [
                "cpe:2.3:a:oracle:siebel_crm_deployment:*:*:*:*:*:*:*:*"
              ],
              "removed": []
            },
            "type": "cpes"
          },
          {
            "details": {
              "added": [
                "oracle",
                "oracle$PRODUCT$siebel_crm_deployment"
              ],
              "removed": []
            },
            "type": "vendors"
          },
          {
            "details": {
              "added": [
                "https://www.oracle.com/security-alerts/cpuoct2026.html"
              ],
              "removed": []
            },
            "type": "references"
          },
          {
            "details": {
              "added": {
                "cvssV3_1": {
                  "score": 6.5,
                  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
                }
              },
              "removed": {},
              "updated": {}
            },
            "type": "metrics"
          }
        ],
        "id": "bd22f0d7-09ab-42a2-8218-ffb108f969eb"
      },
      {
        "created": "2026-10-23T21:30:00+00:00",
        "data": [
          {
            "details": {
              "added": [
                "CWE-284"
              ],
              "removed": []
            },
            "type": "weaknesses"
          },
          {
            "details": {
              "added": {
                "ssvc": {
                  "options": {
                    "Automatable": "no",
                    "Exploitation": "none",
                    "Technical Impact": "partial"
                  },
                  "version": "2.0.3"
                }
              },
              "removed": {},
              "updated": {}
            },
            "type": "metrics"
          }
        ],
        "id": "1eea1f0a-ccfa-418e-9bf6-6693c584d594"
      },
      {
        "created": "2026-10-23T23:00:00+00:00",
        "data": [
          {
            "details": {
              "new": "Unauthorized Data Modification via Low-Privilege HTTP Access in Siebel CRM Deployment",
              "old": null
            },
            "type": "title"
          }
        ],
        "id": "65fee992-7d54-40b4-a740-d63fe1fa59cb"
      },
      {
        "created": "2026-11-04T16:00:00+00:00",
        "data": [
          {
            "details": [
              "oracle$PRODUCT$siebel_crm"
            ],
            "type": "first_time"
          },
          {
            "details": {
              "added": [
                "cpe:2.3:a:oracle:siebel_crm:*:*:*:*:*:*:*:*"
              ],
              "removed": []
            },
            "type": "cpes"
          },
          {
            "details": {
              "added": [
                "oracle$PRODUCT$siebel_crm"
              ],
              "removed": []
            },
            "type": "vendors"
          }
        ],
        "id": "d9c6eab4-8f11-49e3-9b98-320697f2ea52"
      }
    ],
    "cpes": {
      "data": [
        "cpe:2.3:a:oracle:siebel_crm:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:oracle:siebel_crm_deployment:*:*:*:*:*:*:*:*"
      ],
      "providers": [
        "mitre",
        "nvd"
      ]
    },
    "created": {
      "data": "2026-10-20T21:25:52.406000+00:00",
      "provider": "mitre"
    },
    "description": {
      "data": "Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).",
      "provider": "mitre"
    },
    "metrics": {
      "cvssV2_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_1": {
        "data": {
          "score": 6.5,
          "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
        },
        "provider": "mitre"
      },
      "cvssV4_0": {
        "data": {},
        "provider": null
      },
      "epss": {
        "data": {
          "score": 0.00234
        },
        "provider": "first"
      },
      "kev": {
        "data": {},
        "provider": null
      },
      "ssvc": {
        "data": {
          "options": {
            "Automatable": "no",
            "Exploitation": "none",
            "Technical Impact": "partial"
          },
          "version": "2.0.3"
        },
        "provider": "vulnrichment"
      },
      "threat_severity": {
        "data": null,
        "provider": null
      }
    },
    "references": {
      "data": [
        "https://www.oracle.com/security-alerts/cpuoct2026.html"
      ],
      "providers": [
        "mitre",
        "nvd"
      ]
    },
    "title": {
      "data": "Unauthorized Data Modification via Low-Privilege HTTP Access in Siebel CRM Deployment",
      "provider": "enrichment"
    },
    "updated": {
      "data": "2026-11-04T15:53:35.110000+00:00",
      "provider": "nvd"
    },
    "vendors": {
      "data": [
        "oracle",
        "oracle$PRODUCT$siebel_crm",
        "oracle$PRODUCT$siebel_crm_deployment"
      ],
      "providers": [
        "mitre",
        "nvd",
        "enrichment"
      ]
    },
    "weaknesses": {
      "data": [
        "CWE-284"
      ],
      "providers": [
        "nvd",
        "vulnrichment",
        "enrichment"
      ]
    }
  },
  "vulnrichment": {
    "cpes": [],
    "created": "2026-10-20T21:25:52.406000+00:00",
    "description": "Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {},
      "cvssV4_0": {},
      "kev": {},
      "ssvc": {
        "options": {
          "Automatable": "no",
          "Exploitation": "none",
          "Technical Impact": "partial"
        },
        "version": "2.0.3"
      }
    },
    "references": [],
    "title": null,
    "updated": "2026-10-23T20:05:50.207000+00:00",
    "vendors": [],
    "vulnrichment_repo_path": "2026/91xxx/CVE-2026-91420.json",
    "weaknesses": [
      "CWE-284"
    ]
  }
}