cve-2026-91392
LOW CVSS 3.7 opencve
Description
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel CRM End User accessible data. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
Timeline
- Published
- 2026-10-20 22:20 UTC
- Last Modified
- 2026-11-04
CVSS Details
CVSS details not available.
Affected Products
No product information available.
CVSS metrics
| Version | Base | Severity | Vector | Exploitability | Impact | Source |
|---|---|---|---|---|---|---|
| 3.1 | 3.7 | LOW | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N |
mitre | ||
| 3.1 | 3.7 | LOW | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N |
nvd | ||
| 3.1 | 3.7 | LOW | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N |
opencve |
References
No references available.
Linked Vulnerabilities
{
"cve": "CVE-2026-91392",
"enrichment": {
"affected": [
{
"configurations": [
{
"platform": null,
"status": "affected",
"versions": {
"scheme": "generic",
"value": "[17.0,26.9]"
}
}
],
"enrichment": {
"confidence": 100.0,
"confidence_source": "matching",
"scores": [
{
"score": 100.0,
"source": "matching"
}
]
},
"original": {
"product": "Siebel CRM End User",
"source": "cna",
"vendor": "Oracle Corporation"
},
"product": "siebel_crm_end_user",
"vendor": "oracle"
}
],
"created": "2026-10-21T13:30:14.562181+00:00",
"updated": "2026-10-22T09:00:04.081111+00:00",
"vendors": [
"oracle",
"oracle$PRODUCT$siebel_crm_end_user"
]
},
"epss": {
"score": 0.00195
},
"mitre": {
"cpes": [
"cpe:2.3:a:oracle:siebel_crm_end_user:*:*:*:*:*:*:*:*"
],
"created": "2026-10-20T21:25:43.124000+00:00",
"description": "Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel CRM End User accessible data. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).",
"metrics": {
"cvssV2_0": {},
"cvssV3_0": {},
"cvssV3_1": {
"score": 3.7,
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"cvssV4_0": {}
},
"mitre_repo_path": "cves/2026/91xxx/CVE-2026-91392.json",
"references": [
"https://www.oracle.com/security-alerts/cpuoct2026.html"
],
"title": null,
"updated": "2026-10-21T14:21:09.109000+00:00",
"vendors": [
"oracle",
"oracle$PRODUCT$siebel_crm_end_user"
],
"weaknesses": []
},
"nvd": {
"cpes": [
"cpe:2.3:a:oracle:siebel_crm:*:*:*:*:*:*:*:*"
],
"created": "2026-10-20T22:20:42.503000+00:00",
"description": "Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel CRM End User accessible data. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).",
"metrics": {
"cvssV2_0": {},
"cvssV3_0": {},
"cvssV3_1": {
"score": 3.7,
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"cvssV4_0": {}
},
"nvd_repo_path": "2026/CVE-2026-91392.json",
"references": [
"https://www.oracle.com/security-alerts/cpuoct2026.html"
],
"title": null,
"updated": "2026-11-04T15:54:50.337000+00:00",
"vendors": [
"oracle",
"oracle$PRODUCT$siebel_crm"
],
"weaknesses": [
"CWE-306"
]
},
"opencve": {
"changes": [
{
"created": "2026-10-20T21:30:00+00:00",
"data": [
{
"details": {
"new": "Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel CRM End User accessible data. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).",
"old": null
},
"type": "description"
},
{
"details": [
"oracle",
"oracle$PRODUCT$siebel_crm_end_user"
],
"type": "first_time"
},
{
"details": {
"added": [
"cpe:2.3:a:oracle:siebel_crm_end_user:*:*:*:*:*:*:*:*"
],
"removed": []
},
"type": "cpes"
},
{
"details": {
"added": [
"oracle",
"oracle$PRODUCT$siebel_crm_end_user"
],
"removed": []
},
"type": "vendors"
},
{
"details": {
"added": [
"https://www.oracle.com/security-alerts/cpuoct2026.html"
],
"removed": []
},
"type": "references"
},
{
"details": {
"added": {
"cvssV3_1": {
"score": 3.7,
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
}
},
"removed": {},
"updated": {}
},
"type": "metrics"
}
],
"id": "36a883f0-8870-45d2-8c10-9adce42497e4"
},
{
"created": "2026-10-21T13:45:00+00:00",
"data": [
{
"details": {
"new": "Unauthenticated Open UI Data Modification in Oracle Siebel CRM End User",
"old": null
},
"type": "title"
},
{
"details": {
"added": [
"CWE-284"
],
"removed": []
},
"type": "weaknesses"
}
],
"id": "df3ce917-9de1-4e09-a226-95e71b9ed5e9"
},
{
"created": "2026-10-21T17:15:00+00:00",
"data": [
{
"details": {
"added": [
"CWE-306"
],
"removed": []
},
"type": "weaknesses"
},
{
"details": {
"added": {
"ssvc": {
"options": {
"Automatable": "no",
"Exploitation": "none",
"Technical Impact": "partial"
},
"version": "2.0.3"
}
},
"removed": {},
"updated": {}
},
"type": "metrics"
}
],
"id": "460d9527-fb08-45ef-9f8f-32875c14d3ff"
},
{
"created": "2026-10-21T22:30:00+00:00",
"data": [
{
"details": {
"new": null,
"old": "Unauthenticated Open UI Data Modification in Oracle Siebel CRM End User"
},
"type": "title"
},
{
"details": {
"added": [],
"removed": [
"CWE-284"
]
},
"type": "weaknesses"
}
],
"id": "0ca1d600-5f55-4e79-89cb-07de369f33e8"
},
{
"created": "2026-10-22T01:30:00+00:00",
"data": [
{
"details": {
"new": "Unauthenticated Data Modification via Open UI in Siebel CRM End User",
"old": null
},
"type": "title"
}
],
"id": "36845dc8-c770-415b-92b2-76ab7ba57d7e"
},
{
"created": "2026-10-22T09:15:00+00:00",
"data": [
{
"details": {
"new": null,
"old": "Unauthenticated Data Modification via Open UI in Siebel CRM End User"
},
"type": "title"
}
],
"id": "4506cd67-6024-4676-a23e-94ece6ddc68a"
},
{
"created": "2026-11-04T16:00:00+00:00",
"data": [
{
"details": [
"oracle$PRODUCT$siebel_crm"
],
"type": "first_time"
},
{
"details": {
"added": [
"cpe:2.3:a:oracle:siebel_crm:*:*:*:*:*:*:*:*"
],
"removed": []
},
"type": "cpes"
},
{
"details": {
"added": [
"oracle$PRODUCT$siebel_crm"
],
"removed": []
},
"type": "vendors"
}
],
"id": "369604ca-06af-4d6d-8d0a-ac1b787750bb"
}
],
"cpes": {
"data": [
"cpe:2.3:a:oracle:siebel_crm:*:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:siebel_crm_end_user:*:*:*:*:*:*:*:*"
],
"providers": [
"mitre",
"nvd"
]
},
"created": {
"data": "2026-10-20T21:25:43.124000+00:00",
"provider": "mitre"
},
"description": {
"data": "Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel CRM End User accessible data. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).",
"provider": "mitre"
},
"metrics": {
"cvssV2_0": {
"data": {},
"provider": null
},
"cvssV3_0": {
"data": {},
"provider": null
},
"cvssV3_1": {
"data": {
"score": 3.7,
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"provider": "mitre"
},
"cvssV4_0": {
"data": {},
"provider": null
},
"epss": {
"data": {
"score": 0.00195
},
"provider": "first"
},
"kev": {
"data": {},
"provider": null
},
"ssvc": {
"data": {
"options": {
"Automatable": "no",
"Exploitation": "none",
"Technical Impact": "partial"
},
"version": "2.0.3"
},
"provider": "vulnrichment"
},
"threat_severity": {
"data": null,
"provider": null
}
},
"references": {
"data": [
"https://www.oracle.com/security-alerts/cpuoct2026.html"
],
"providers": [
"mitre",
"nvd"
]
},
"title": {
"data": null,
"provider": null
},
"updated": {
"data": "2026-11-04T15:54:50.337000+00:00",
"provider": "nvd"
},
"vendors": {
"data": [
"oracle",
"oracle$PRODUCT$siebel_crm",
"oracle$PRODUCT$siebel_crm_end_user"
],
"providers": [
"mitre",
"nvd",
"enrichment"
]
},
"weaknesses": {
"data": [
"CWE-306"
],
"providers": [
"nvd",
"vulnrichment"
]
}
},
"vulnrichment": {
"cpes": [],
"created": "2026-10-20T21:25:43.124000+00:00",
"description": "Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel CRM End User accessible data. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).",
"metrics": {
"cvssV2_0": {},
"cvssV3_0": {},
"cvssV3_1": {},
"cvssV4_0": {},
"kev": {},
"ssvc": {
"options": {
"Automatable": "no",
"Exploitation": "none",
"Technical Impact": "partial"
},
"version": "2.0.3"
}
},
"references": [],
"title": null,
"updated": "2026-10-21T14:21:03.658000+00:00",
"vendors": [],
"vulnrichment_repo_path": "2026/91xxx/CVE-2026-91392.json",
"weaknesses": [
"CWE-306"
]
}
}
Enrichment data
Aggregated bundle (all enrichments)