The flaw exists in the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications and permits an attacker who has access to the physical communication segment where the application runs to bypass authentication controls. This breach enables the exploitation of insecure access control to insert, update, delete, and read stored data, thereby compromising the confidentiality and integrity of the application’s information. The vulnerability is an example of improper authorization (CWE-284).

Oracle Corporation’s Siebel CRM Cloud Applications, versions 22.3 through 26.9, are affected. The issue was identified and documented in an Oracle security advisory and applies to all installations of the specified releases.

The CVSS base score of 4.7 reflects moderate severity, with low confidentiality and integrity impacts combined with an adjacency network attack vector, high attack complexity and no user interaction. The EPSS score indicates the probability of exploitation is below 1%, and the vulnerability not listed in the CISA KEV catalog, suggesting no widespread known exploitation. Nonetheless, the requirement for local network physical access means the risk is largely dependent on the host environment’s physical security posture and could enable scope changes to other Oracle products if privilege escalation occurs.