This vulnerability resides in the Siebel Cloud Manager component of the Oracle Siebel CRM Cloud Applications. An attacker who is unauthenticated but can access the physical communication segment attached to the hardware where the application runs can compromise the application. Successful exploitation allows the attacker to create, delete, or modify critical data, and to gain unauthorized access to all data accessible through the application. The CVSS vector indicates a high base score of 8.0 with impacts on confidentiality and integrity, while availability is not affected.

The affected product is Oracle Corporation’s Siebel CRM Cloud Applications, versions 22.3 through 26.9 inclusive. No other vendors or versions are listed as affected.

The vulnerability carries a high severity CVSS score and is listed in Oracle’s October 2026 security alert. Exploitation requires physical network access to the segment connected to the application’s hardware, limiting the attacker’s reach but still enabling serious damage if access is achieved. The EPSS score is less than 1%, and the vulnerability is not included in the CISA KEV catalog.