A difficult-to-exploit flaw in Siebel CRM Cloud Applications permits an unauthenticated attacker with access to the physical communication segment attached to the hardware executing the application to compromise the system. Successful exploitation can lead to unauthorized access to critical data, access to all data stored in the application, and the ability to perform insert, update, or delete operations on that data, affecting both confidentiality and integrity.

The vulnerability affects Oracle Siebel CRM Cloud Applications of Oracle Corporation. Supported affected versions range from 22.3 through 26.9.

The CVSS v3.1 base score of 5.9 indicates moderate severity with high confidentiality impact and low integrity impact. EPSS score is <1%, and the vulnerability is not yet listed in the CISA KEV catalog. The stated attack vector is adjacent network, meaning that an attacker must have physical proximity or network access to the hardware segment where the application runs. With no authentication required (PR:N, UI:N), the flaw allows attackers to gain independent control once the physical access condition is met.