A flaw in the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications enables a low‑privileged attacker who can reach the application over HTTP to obtain unauthorized access to sensitive data. The vulnerability is fully exploitable once the attacker has network connectivity, and the impact is limited to confidentiality, allowing the attacker to read or obtain all database records exposed through the application. Because the integrity and availability vectors are not affected, compromising the data does not alter it or disrupt services, but it does expose critical information to the attacker.

The affected products are Oracle Siebel CRM Cloud Applications supplied by Oracle Corporation. Versions from 22.3 through 26.9 are susceptible to this problem, and the issue is specifically located in the Siebel Cloud Manager component.

The CVSS 3.1 score of 6.5 indicates a moderate risk that can be achieved without advanced skills. The likely attack vector is network traffic over HTTP, inferred from the fact that the description states “network access via HTTP.” The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that while the vulnerability could be serious in an environment where the affected version is used, there is no public evidence yet of widespread exploitation. The attacker only needs local network privileges, making it a reasonable risk in environments that expose the application over the internet or an internal LAN without strict access controls.