Oracle Siebel CRM CVE-2026-101438

Exploitation requires the attacker to have access to the physical communication segment attached to the hardware where Siebel CRM Cloud Applications executes (CVSS AV:A - adjacent, not internet-reachable), targeting the Siebel Cloud Manager component in affected versions 22.3 through 26.9. No authentication is required (PR:N) and no user interaction is needed (UI:N), but the High attack complexity (AC:H) means specific conditions outside the attacker's control must be satisfied for a reliable attack. The primary limiting factors are the adjacent-access requirement (the attacker must already be on the local/physical network segment) and the high-complexity precondition, both of which significantly reduce exposure versus a remote network-exploitable flaw; availability is unaffected (A:N).

This is a genuinely serious flaw (CVSS 3.1 8.0, HIGH) but its real-world exploitability is meaningfully constrained, and several signals pull in opposite directions. The CVSS vector confirms unauthenticated exploitation (PR:N) with no user interaction (UI:N) and a scope change (S:C), yielding high confidentiality and integrity impact (C:H/I:H) but no availability impact (A:N). Critically, the attack vector is Adjacent (AV:A) - Oracle's description clarifies this means the attacker needs access to the physical communication segment attached to the hardware running the product, NOT internet-facing network reach - and attack complexity is High (AC:H), indicating conditions outside the attacker's control must be met. There is no EPSS score, no CISA KEV listing, and no known public exploit provided in the input, so exploitation remains theoretical at this time. The combination of adjacent-only access plus high complexity substantially lowers practical risk relative to the 8.0 score: this is a prioritize-for-patching item in the normal Oracle CPU cadence rather than an emergency, drop-everything fix, though the scope change and critical-data impact warrant attention for environments where attackers could gain local network-segment footing. Note a labeling tension: the input Tags include 'Authentication Bypass,' but the description does not actually describe an authentication-bypass mechanism - verify the vulnerability class with Oracle, as CWE is listed as N/A.

An attacker who has already gained a foothold on the same physical/local communication segment as a Siebel CRM Cloud Applications host (e.g., a compromised adjacent server or network device) crafts traffic against the Siebel Cloud Manager component. By meeting specific non-trivial conditions (reflected in the High attack complexity), they read or modify critical Siebel data without authentication, and the scope change lets the impact extend to additional connected products. No public proof-of-concept exploit is identified in the available data.