A vulnerability in the Siebel CRM Cloud Manager component of Oracle Siebel CRM Cloud Applications permits a low‑privileged attacker who can reach the system over the network to use LDAP access in a way that allows them to bypass normal authorization checks. The effect is discovery and exfiltration of confidential data or, in worst cases, full access to all data available within Siebel CRM Cloud Applications. The weakness is a failure of proper authorization controls, leading to a confidentiality breach as reflected in the CVSS vector, which rates the impact on confidentiality only.

Oracle Corporation’s Siebel CRM Cloud Applications, versions 22.3 through 26.9, are affected. The vulnerability exists in the Siebel Cloud Manager component that processes LDAP requests.

The CVSS v3.1 Base Score of 6.5 indicates moderate severity; the score reflects that the exploit is network‑accessible, low effort, and requires that the attacker have a low‑privileged account. EPSS data are available and indicate a very low exploitation probability (EPSS score 0.00355). The vulnerability is not listed in the CISA KEV catalog. The likely attack path is remote LDAP access, potentially via crafted requests that exploit improper input or authorization validation. No public exploit has been reported as of the data provided, but the fact that the flaw is easily exploitable raises the potential for earlier or undisclosed use by attackers.