The vulnerability is an improper access control flaw (CWE-863) that allows a low-privileged attacker who can log into the infrastructure hosting the Siebel CRM Cloud Applications to obtain unauthorized read access to critical data. The CVSS v3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H indicates that the flaw primarily affects confidentiality, permitting data disclosure without impacting integrity or availability.

Oracle Siebel CRM Cloud Applications, affected versions 22.3 through 26.9. The issue resides in the Siebel Cloud Manager component and is relevant to all deployments of this product within the specified version range.

With a CVSS score of 5.5, the vulnerability represents a moderate risk. The EPSS score is 0.00152 (< 1%), and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited known exploitation. The likely attack vector is local since the attacker must have logon access to the host; the simple exploitation conditions (low complexity and low privilege) mean that an attacker who gains infrastructure access can readily compromise the CRM applications to read data.