This vulnerability exists in the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications. It is described as “easily exploitable” and permits a low‑privileged attacker who has logged onto the underlying infrastructure to compromise the application. Achieving exploitation results in unauthorized read or full access to all data exposed by the application, thereby causing a confidentiality breach. The CVSS vector indicates local attack, low authentication requirements, and direct control over privileged actions, with a base score of 6.5.

Oracle Siebel CRM Cloud Applications versions 22.3 through 26.9 are affected. The vulnerability is confined to the Siebel Cloud Manager component; no other versions are reported to be impacted.

The CVSS score of 6.5 places this flaw in the medium severity range. Although it demands only local infrastructure logon, it is considered “easily exploitable” and is not yet listed in the CISA KEV catalog. The EPSS score is unavailable, suggesting that public exploitation is currently limited but still possible. Given the potential for full data disclosure, administrators should treat the flaw with priority and apply the vendor-provided fix as soon as it is available.