The flaw in the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications allows an attacker who can reach the LDAP service over the network to authenticate as no user and obtain privileged access. The vulnerability does not require any credentials and is difficult to exploit, but once successful it grants read access to all data stored in the system, thereby creating a confidentiality breach that could expose customer or business information.

Oracle Siebel CRM Cloud Applications – the Siebel Cloud Manager component, versions 22.3 through 26.9. No other Oracle releases are listed as vulnerable.

The CVSS 3.1 Base Score of 5.9 indicates moderate severity with a focus on confidentiality. The EPSS score of less than 1% reflects a very low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. The attack requires network access to the LDAP interface; the attacker can send unauthenticated LDAP requests without privilege escalation or additional system access to extract sensitive data.