The vulnerability enables an attacker with high privileges and network access to the Siebel Cloud Manager component to create, delete, or modify critical data and read a subset of data, undermining confidentiality and integrity. The CVSS vector indicates the attack requires network access, high complexity, and high privileges but no user interaction, and the scope is changed, allowing effects beyond the originally affected component. This weakness is rooted in improper authorization controls.

Affected systems are Oracle Siebel CRM Cloud Applications, versions 22.3 through 26.9 inclusive. The component impacted is the Siebel Cloud Manager. All other dependent services may also experience scope changes if the vulnerability is exploited.

The CVSS base score is 6.6, indicating moderate to high risk. The EPSS score is less than 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Exploitation requires an attacker who can reach the application via HTTP and has high privileged access, at which point the attacker can alter or read sensitive data. Given the lack of publicly known exploits, the likelihood of immediate exploitation remains uncertain, but the potential impact is significant for confidentiality and integrity of CRM data.