This vulnerability in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component) affects supported versions 22.3 through 26.5. It permits an unauthenticated attacker with network access over HTTP to compromise the application, resulting in unauthorized access to critical or complete accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects that the attack can be performed remotely with low complexity, no privileges, and no user interaction, impacting confidentiality but not integrity or availability. The vendor advisory from Oracle (July 2026 Critical Patch Update) references multiple patches but does not explicitly confirm a patch for this specific vulnerability at the time of publication. Patch status is therefore not yet confirmed and should be verified with Oracle's advisory.

Successful exploitation leads to unauthorized access to critical or all accessible data in Siebel CRM Cloud Applications, compromising confidentiality. There is no reported impact on integrity or availability. The vulnerability can be exploited remotely without authentication or user interaction, increasing the risk of data exposure.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to the affected application where possible to limit exposure.