A flaw in the Siebel Cloud Manager component enables an attacker with physical access to the network segment used by Oracle Siebel CRM Cloud Applications to bypass authentication and ultimately gain full control of the application. This authentication bypass can lead to loss of confidentiality, integrity, and availability of all customer data stored in Siebel. The weakness aligns with improper access control (CWE‑284), information exposure (CWE‑200), and incorrect permissions (CWE‑732).

Oracle Siebel CRM Cloud Applications, component Siebel Cloud Manager. Affected releases include version 17.0 through 26.5. No other products or upstream components are listed as vulnerable.

The vulnerability carries a CVSS 3.1 Base Score of 8.3, indicating high severity. The EPSS score is reported as less than 1 %, meaning the likelihood of exploitation is currently low but not zero. It is not listed in CISA’s KEV catalog. The attack requires only physical proximity to the communication segment, representing an adjacent‑network vector; the scope change in the metric indicates that a successful compromise will result in full system takeover.