# CVE-2026-91447: Oracle Siebel CRM Deployment unauthorized data access

Source: https://junglewise.ai/threats/cve-2026-91447-vulnerability-in-the-siebel-crm-deployment-product-of-oracle  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-91447 · Severity: high · CVSS 7.5 · Published 2026-10-20

Oracle Siebel CRM Deployment is a server component that manages customer relationship management deployments. An unauthenticated attacker on the network can exploit an easily exploitable vulnerability in the HTTP interface to gain unauthorized access to all data stored in Siebel CRM, exposing sensitive customer and business information without requiring valid credentials.

Technologies: [Oracle Siebel CRM Deployment](https://junglewise.ai/threats/technologies/siebel-crm-deployment). Vendors: [Oracle](https://junglewise.ai/threats/vendors/oracle).

## Quick answers

**Is CVE-2026-91447 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-91447 being exploited in the wild.

**How severe is CVE-2026-91447?** High severity, with a CVSS score of 7.5, published 20 October 2026.

**Which products and versions are affected?** Oracle Siebel CRM Deployment 17.0-26.9.

**Is there a fix for CVE-2026-91447?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-91447 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-91447?** Check whether you run Oracle Siebel CRM Deployment at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An easily exploitable vulnerability in the Siebel CRM Deployment Server Infrastructure component allows unauthenticated attackers with network access via HTTP to bypass authentication controls and access sensitive data. The vulnerability requires no user interaction and affects versions 17.0 through 26.9. Successful exploitation results in complete unauthorized access to all CRM data with high confidentiality impact but no integrity or availability impact.

## Affected products

- Oracle Siebel CRM Deployment 17.0-26.9

## Timeline

- 2026-10-20: disclosed

## References

- [https://www.oracle.com/security-alerts/cpuoct2026.html](https://www.oracle.com/security-alerts/cpuoct2026.html)

## Related threats

- [Oracle Siebel CRM unauthorized data access in Server Infrastructure](https://junglewise.ai/threats/cve-2026-91450-vulnerability-in-the-siebel-crm-deployment-product-of-oracle)
- [Oracle Siebel CRM Deployment unauthorized data access via HTTP](https://junglewise.ai/threats/cve-2026-91449-vulnerability-in-the-siebel-crm-deployment-product-of-oracle)
- [Oracle Siebel CRM Deployment unauthenticated data access](https://junglewise.ai/threats/cve-2026-91448-vulnerability-in-the-siebel-crm-deployment-product-of-oracle)
- [Oracle Siebel CRM privilege escalation in Server Infrastructure](https://junglewise.ai/threats/cve-2026-91444-vulnerability-in-the-siebel-crm-deployment-product-of-oracle)
- [Oracle Siebel CRM Deployment unauthorized data access in Server Infrastructure](https://junglewise.ai/threats/cve-2026-91443-vulnerability-in-the-siebel-crm-deployment-product-of-oracle)