A local vulnerability in the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications requires an attacker to already have high‑privileged access on the host system. Once exploited, the attacker can compromise the application and gain unauthorized access to critical data, affecting confidentiality. The CVSS 3.1 base score is 4.1, indicating a moderate threat level with impact limited to confidentiality.

Oracle Siebel CRM Cloud Applications, versions 22.3 through 26.9 are affected.

The vulnerability is local (AV:L) and requires an attacker to have high‑level credentials on the infrastructure. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalogue, suggesting limited public exploitation. Nevertheless, internal threat actors with sufficient privileges could exploit the flaw to access privileged data, so the risk is moderate for environments where local administrative rights are broadly granted.