Oracle Siebel CRM CVE-2026-47018

The only hard prerequisite is network reachability to the Siebel Cloud Manager component over HTTPS on an affected Siebel CRM Cloud Applications instance running a version between 22.3 and 26.5; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no elevated privileges, and no user interaction are required against a standard-reachable deployment. The primary limiting factor is exposure: exploitation requires that the attacker can actually connect to the Cloud Manager HTTPS endpoint, so instances isolated behind management-network access controls, VPN, or firewalls are not reachable by arbitrary internet attackers. The impact is bounded to denial of service - there is no path to data disclosure or modification (C:N/I:N) - which limits the consequence to availability loss even when the conditions are met.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) describes an easily exploitable, network-reachable, unauthenticated condition with no user interaction, which normally signals high urgency. However, the sole impact is availability - a complete DOS - with zero confidentiality or integrity effect, so this is a service-disruption risk, not a data-breach or code-execution risk. There is no public exploit identified at time of analysis and no CISA KEV listing, and no EPSS score was provided in the input, so real-world exploitation probability cannot be quantified from the data given. SSVC-style reasoning: exploitation status is 'none' (no observed activity or POC), the flaw is likely automatable given AC:L/PR:N/UI:N, and technical impact is partial (availability-only, not total system compromise). Net: a genuine priority for internet-exposed Siebel Cloud Manager instances where uptime is critical, but lower urgency than a same-score RCE or data-exposure bug because an attacker gains only disruption. Note the confidentiality/integrity metrics are explicitly N, so this should not be treated as a system-compromise vulnerability.

An attacker who can reach the Siebel Cloud Manager HTTPS interface sends a specially crafted request or request sequence that drives the application into a hang or repeatable crash, taking Siebel CRM Cloud Applications offline for all users. No credentials, user interaction, or elevated privileges are needed given AV:N/AC:L/PR:N/UI:N, and the attack can be repeated to sustain the outage. No public proof-of-concept has been identified at time of analysis.