Local privilege escalation in the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications allows a high‑privileged attacker who has logged on to the host system to compromise the application and gain unauthorized access to critical data or all data managed by the CRM. This weakness is identified as CWE‑862 (Missing Authorization). The CVSS 3.1 vector indicates a local attack with high privileges and no user interface, reflecting a confidentiality‑only impact of moderate severity.

Oracle Siebel CRM Cloud Applications versions 22.3 through 26.9 are affected; all deployments of the Siebel Cloud Manager component on these releases are vulnerable.

The vulnerability can be exploited only locally and requires existing high‑level access to the host that runs the application, making it unsuitable for remote attackers. The EPSS score of less than 1 % and absence from the CISA KEV catalog suggest a low probability of public exploitation. However, environments in which administrators have broad local privileges could use the flaw to read sensitive data, while strictly least‑privileged setups face a much lower risk. The CVSS base score of 4.1 denotes a moderate confidentiality concern for affected systems.