EUVD-2026-47062
GHSA-722j-8chj-5frr
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Local attack requires existing low-privileged infrastructure logon; partial data read/write impact with no availability loss confirms C:L/I:L/A:N.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel CRM Cloud Applications accessible data as well as unauthorized read access to a subset of Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 4.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
AnalysisAI
Siebel Cloud Manager in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.5) exposes an authentication bypass that permits low-privileged local users to read and modify CRM data beyond their authorized scope. The flaw requires an existing logon to the infrastructure hosting the application, constraining the attack surface to internal or compromised users rather than remote internet-based attackers. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; the CVSS 4.4 Medium rating reflects these limiting factors.
Technical ContextAI
The affected component is Siebel Cloud Manager, the administrative and orchestration layer within Oracle Siebel CRM Cloud Applications. The CVSS vector (AV:L) confirms exploitation requires local access to the infrastructure where the application executes, consistent with the description's 'logon to the infrastructure' prerequisite. The 'Authentication Bypass' tag indicates the flaw likely involves circumventing an authorization or access control check within Cloud Manager, allowing a low-privileged principal to exceed their data permission boundaries. No CWE identifier was assigned by the reporter (listed as N/A), so the precise root cause class - whether broken access control, improper authorization, or session handling - cannot be confirmed from available data. No CPE string was provided; affected scope is defined as Oracle Siebel CRM Cloud Applications versions 22.3 through 26.5 per the July 2026 Oracle Critical Patch Update.
RemediationAI
Apply Oracle's Critical Patch Update for July 2026, referenced at https://www.oracle.com/security-alerts/cpujul2026.html. No explicit fixed version number beyond 'apply the CPU' has been confirmed in the available data - customers should follow Oracle's CPU patching guidance for the Siebel CRM product family. As a compensating control while patching is scheduled, restrict logon access to the infrastructure hosting Siebel CRM Cloud Applications to the minimum set of users who require it, directly reducing the attacker pool for this local-access flaw. Additionally, audit and harden access controls within Siebel Cloud Manager, particularly for low-privileged accounts, to limit data accessible via any bypass. Monitor infrastructure authentication and data access logs for anomalous read or write activity by non-administrative accounts. These compensating measures do not eliminate the underlying flaw and should not substitute for applying the CPU.
More in Siebel Cloud Manager
View allFull application takeover in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.5) allows a low-privileged,
Local authentication bypass in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component) versions 22.3 throu
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today