This vulnerability in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component) affects supported versions 22.3 through 26.5. It allows an attacker with low privileges and logon access to the underlying infrastructure to compromise the application by gaining unauthorized read and write access to some data. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) indicates local attack vector with low complexity, requiring privileges but no user interaction, impacting confidentiality and integrity partially. Oracle's July 2026 Critical Patch Update advisory lists this vulnerability among many others but does not explicitly state a patch or fix for it. The vendor strongly recommends applying security patches promptly, but patch status for this specific vulnerability is not confirmed.

Successful exploitation permits unauthorized read access to a subset of Siebel CRM Cloud Applications data and unauthorized update, insert, or delete access to some accessible data. This compromises data confidentiality and integrity to a limited extent. There is no impact on availability. The attacker must have low privileged logon access to the infrastructure where the application runs, limiting remote exploitation. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends customers remain on actively supported versions and apply security patches without delay. Since this vulnerability requires local logon privileges, restricting access to the infrastructure and enforcing strong access controls can reduce risk. Monitor Oracle advisories for updates on patch availability.