Is CVE-2026-91437 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-91437 being exploited in the wild.

How severe is CVE-2026-91437?

High severity, with a CVSS score of 8.7, published 20 October 2026.

Which products and versions are affected?

Oracle Siebel CRM Deployment 17.0 through 26.9.

Is there a fix for CVE-2026-91437?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-91437 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-91437?

Check whether you run Oracle Siebel CRM Deployment at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-91437: Oracle Siebel CRM Deployment data access vulnerability in Server Infrastructure

CVE-2026-91437 · Severity: high · CVSS 8.7 · Published 2026-10-20

A vulnerability in Oracle Siebel CRM's deployment infrastructure allows a high-privileged network attacker to bypass controls and gain unauthorized access to critical customer data. An attacker with existing administrative credentials can read, modify, or delete sensitive business information stored in Siebel CRM, potentially affecting all data accessible to the system. This vulnerability has a CVSS score of 8.7 and could impact financial records, customer information, and other mission-critical data.

Technologies: Oracle Siebel CRM Deployment. Vendors: Oracle.

Quick answers

Is CVE-2026-91437 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-91437 being exploited in the wild.
How severe is CVE-2026-91437?: High severity, with a CVSS score of 8.7, published 20 October 2026.
Which products and versions are affected?: Oracle Siebel CRM Deployment 17.0 through 26.9.
Is there a fix for CVE-2026-91437?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-91437 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-91437?: Check whether you run Oracle Siebel CRM Deployment at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An easily exploitable vulnerability in the Siebel CRM Deployment Server Infrastructure component (versions 17.0–26.9) allows a high-privileged attacker with network access via HTTP to compromise data confidentiality and integrity. The vulnerability requires high privilege level (PR:H) but no user interaction, resulting in both confidentiality and integrity impact with potential scope change affecting other products. A fix is stated to be available in unspecified patched versions.

Affected products

Oracle Siebel CRM Deployment 17.0 through 26.9

Timeline

2026-10-20: disclosed

References

https://www.oracle.com/security-alerts/cpuoct2026.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.