This vulnerability affects the Siebel CRM Cloud Applications product of Oracle Siebel CRM, specifically the Siebel Cloud Manager component. Versions 22.3 through 26.7 are impacted. The flaw allows an unauthenticated attacker who has access to the physical communication segment attached to the hardware where the application executes to compromise the system. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with no availability impact. The attack vector is adjacent network (AV:A), requiring no privileges or user interaction, and the scope is unchanged. Oracle has published a Critical Security Patch Update advisory referencing this vulnerability, recommending patch application.

Exploitation can result in unauthorized creation, deletion, or modification of critical data within Siebel CRM Cloud Applications, potentially giving attackers complete access to all accessible data. This compromises confidentiality and integrity of the system's data. There is no reported impact on availability. The vulnerability requires physical network segment access, limiting remote exploitation.

Oracle has released security patches addressing this vulnerability as part of their September 2026 Critical Security Patch Update. Customers should apply the relevant patches promptly to remediate the issue. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. Since this is not a cloud service, remediation is managed by the customer through patch application. Patch status is confirmed by the vendor advisory.