A vulnerability exists in the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications that allows an unauthenticated network attacker to access HTTP endpoints and read a subset of application data. The flaw does not provide privilege escalation, code execution, or denial of service, but it does compromise confidentiality of the exposed data, as indicated by the CVSS 3.1 vector showing a low confidentiality impact.

Oracle Corporation’s Siebel CRM Cloud Applications, versions 22.3 through 26.9, are affected. The vulnerability pertains specifically to the Siebel Cloud Manager component within these releases.

The CVSS score of 3.7 indicates a low severity level. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating that no mass exploitation campaigns are known. Exploitation requires simple network access over HTTP, no authentication, high attack complexity, and no user interaction, which means it is not trivial for attackers to abuse but could be used to quietly exfiltrate limited data.