A vulnerability exists in the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications that allows an unauthenticated attacker who can physically access the network segment of the hardware hosting the system to compromise the application. A successful exploit can grant the attacker unauthorized read access to critical data, or in worst‑case scenarios, complete read‑write access to all data exposed by the application, enabling data updates, inserts, or deletions. The weakness stems from improper access control and missing authentication mechanisms, as identified by CWE‑306.

Oracle Corporation’s Siebel CRM Cloud Applications, versions 22.3 through 26.9. The vulnerability specifically affects the Siebel Cloud Manager component that manages the SaaS offering.

The CVSS score of 5.9 reflects moderate severity, with the EPSS score of < 1% indicating a very low probability of exploitation in the wild. The attack requires physical network access, and there is no CISA KEV listing for this vulnerability. While the lack of authentication reduces the barrier once the attacker reaches the physical segment, the high attack complexity and adjacent network access mode mean that exploitation is limited to insiders or individuals with direct physical presence at the site where Siebel CRM is deployed.