This vulnerability in Oracle Siebel CRM Cloud Applications allows an unauthenticated attacker with network access via HTTP to read a subset of data stored in the system. The flaw is easily exploitable and does not require credentials, privileges, or user interaction. Because the attack compromises confidentiality, the CVSS 3.1 Base Score is 5.3 and the assessment highlights that the main impact is limited to privacy of the exposed data.

The flaw affects Oracle Corporation’s Siebel CRM Cloud Applications, specifically the Siebel Cloud Manager component, in the supported version range 22.3 through 26.9.

With a CVSS score of 5.3 and no published EPSS data, the vulnerability carries moderate severity and an uncertain but potentially non‑negligible likelihood of exploitation. It is not listed in the CISA KEV catalog, and the attack requires only network connectivity to the HTTP interface. The attacker can exploit the flaw through standard HTTP requests without additional access or elevated permissions, making the path straightforward for network‑connected adversaries.