A local attacker who has logged onto the infrastructure that hosts the Oracle Siebel CRM Cloud applications can exploit a flaw in the Siebel Cloud Manager component. The vulnerability allows the attacker to perform unauthorized updates, inserts, deletes, or reads against data that should be protected by the application’s access controls. Because the attacker can alter or disclose information, confidentiality and integrity of the data are compromised while availability remains unaffected.

Oracle Siebel CRM Cloud Applications, versions 22.3 through 26.9, are affected by the flaw located in the Siebel Cloud Manager module that administers access control within the CRM.

The CVSS base score of 3.6 indicates a low‑severity issue, and the EPSS score of less than 1% suggests a very small likelihood of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog, and no exploitation evidence has been reported. Because the attack requires local access to the host, environments where low‑privileged accounts have unrestricted access pose a higher risk; nevertheless, the overall exploitation probability remains low.