This vulnerability in Oracle Siebel CRM Cloud Applications (component: Siebel Cloud Manager) affects versions 22.3 to 26.6. An unauthenticated attacker with physical network segment access can exploit this flaw to gain unauthorized creation, deletion, or modification privileges over critical data or gain complete access to all accessible data within the application. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with no impact on availability. The attack vector is adjacent network (AV:A), requiring no privileges or user interaction.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data within Siebel CRM Cloud Applications, or unauthorized access to all accessible data. This compromises data confidentiality and integrity but does not affect availability. The vulnerability requires physical access to the communication segment attached to the hardware, limiting remote exploitation.

Oracle has published a Critical Security Patch Update advisory recommending customers apply security patches without delay. However, no explicit patch link or fixed version is provided for this specific vulnerability in the advisory content. Customers should monitor Oracle's official security alerts and apply relevant patches promptly when available. Since this is not a cloud service, remediation depends on customer patching. Restricting physical access to the communication segment is also a critical mitigation step.