This vulnerability is an unauthenticated HTTP access flaw in the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications. An attacker with network connectivity can request data over standard HTTP and obtain a subset of the application’s data without needing valid credentials. The flaw is rated as a moderate confidentiality impact (CVSS 3.1 base score 5.3 with a low confidentiality effect) and does not affect integrity or availability.

Affected vendors and products include Oracle Corporation’s Siebel CRM Cloud Applications. Versions in the 22.3‑26.9 range are vulnerable, meaning any deployment running those releases is at risk until the vulnerability is remediated.

The CVSS of 5.3 indicates a moderate risk, and the EPSS score is not listed, suggesting that no widespread exploitation has been observed publicly. The vulnerability is not present in the CISA KEV catalog. The likely attack vector is network‑based via standard HTTP, requiring no authentication or privilege. An attacker can read privileged data if the attacker can reach the Siebel Cloud Manager endpoint, but the attack does not provide code execution or denial of service capabilities.