A flaw in the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications allows an unauthenticated attacker who can physically access the communication segment connected to the hardware where the application runs to bypass authentication and read sensitive data. The vulnerability is a confidentiality breach, classified by CWE-306 (Missing Authentication). Successful exploitation would enable the attacker to access critical data stored in the application or, at worst, all data available to the application.

Oracle Siebel CRM Cloud Applications versions 22.3 through 26.9 are impacted. The flaw resides in the Siebel Cloud Manager component and affects any installation where the physical communication segment is reachable by an attacker.

The CVSS v3.1 base score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation under normal circumstances. The vulnerability is not listed in CISA’s KEV catalog, but environments that provide an attacker with physical access to the communication segment remain at risk for confidential data exposure. The primary attack vector requires physical proximity and the ability to connect to the hardware’s communication interface.