The vulnerability is an access control flaw in the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications. It allows an attacker with limited privileges and access to the physical communication segment of the hardware where the application runs to gain unauthorized access to critical data. The attacker may also update, insert, or delete accessible data, and induce a partial denial of service, affecting confidentiality, integrity, and availability.

Oracle’s Siebel CRM Cloud Applications, versions 22.3 through 26.7, are affected. The flaw resides in the Siebel Cloud Manager component; any user or system connected to the same physical network segment as the application can potentially exploit it.

The CVSS 3.1 base score is 8.2, reflecting high impact with confidentiality high, integrity low, and availability low. The EPSS score is below 1%, indicating low current exploitation probability, and the vulnerability has not been catalogued as a known exploited vulnerability (KEV). However, the vulnerability’s scope can extend beyond the immediate product if other applications are linked, and attackers only need low privileges and local network access, which makes the attack likely if the target environment is accessible.