The vulnerability allows an unauthenticated attacker who has access to the physical communication segment connected to the hardware running Siebel CRM Cloud Applications to compromise the application. Exploitation can result in unauthorized creation, deletion, or modification of data, and potentially full access to all data stored in the application. The weakness stems from insufficient access controls that permit an attacker to perform privileged actions without authentication.

Oracle Siebel CRM Cloud Applications, specifically the Siebel Cloud Manager component, versions 22.3 through 26.9 are affected.

The CVSS base score of 6.8 indicates a medium severity with impacts on confidentiality and integrity. The attack vector is adjacent network (AV:A) and requires no existing authentication or user interface interaction. The EPSS score is not available and the issue is not listed in the CISA KEV catalog, suggesting that active exploitation may be low but the potential impact remains significant for systems on the same physical network segment.