Siebel Cloud Manager CVE-2026-101443

Exploitation requires a low-privileged authenticated account on Siebel CRM Cloud Applications (PR:L) and network reachability to the Siebel Cloud Manager component over LDAP; it affects supported versions 22.3 through 26.9. No user interaction is needed (UI:N) and complexity is low (AC:L). Limiting factors: the attacker must first authenticate with at least low privileges - this is not an unauthenticated flaw - and impact is confined to confidentiality (C:H, I:N, A:N), so data disclosure is the only outcome, with no integrity tampering or service disruption. Realistic risk is further bounded by whether the LDAP-facing Siebel Cloud Manager interface is exposed beyond trusted networks.

This is a medium-severity issue (CVSS 3.1 base 6.5) that warrants routine patching rather than emergency response. The vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) describes a network-reachable, low-complexity attack requiring low-level privileges (PR:L) and no user interaction, yielding full confidentiality loss but no integrity or availability impact. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this reads as a high-CVSS-for-confidentiality but not an imminently exploited issue. A notable conflict exists: the input Tags include 'Authentication Bypass,' yet both the description ('low privileged attacker') and the CVSS vector (PR:L) require an authenticated foothold, which directly contradicts a true authentication-bypass characterization - verify the tag against the Oracle advisory. SSVC-style framing: exploitation is not observed, automatability is unclear (LDAP-based, authenticated), and technical impact is partial (confidentiality only). Net priority: moderate - patch in the normal Oracle CPU cycle, prioritizing internet-exposed Siebel Cloud Manager instances.

An attacker who already holds a low-privileged Siebel CRM Cloud Applications account sends crafted requests over LDAP to the Siebel Cloud Manager component, abusing the flaw to read data far beyond their authorization level - up to all data accessible to the application. Because attack complexity is low and no user interaction is needed, a single authenticated session on the network path to the service is sufficient; no public exploit code was identified in the provided data.