Siebel Cloud Manager CVE-2026-91359

Exploitation requires network access to an exposed Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications over HTTP; no authentication, privileges, or user interaction are needed (PR:N/UI:N), making any internet- or network-reachable instance of the affected component the attack surface. The practical limiting factors are: the affected product must be a Siebel CRM Cloud Applications deployment running an affected version in the range 22.3 through 26.9, the Siebel Cloud Manager component specifically must be reachable by the attacker, and the impact is confined to unauthorized read access to only a subset of accessible data - there is no write/integrity or availability impact to leverage for further compromise.

This is a moderate-severity information-disclosure flaw (CVSS 3.1 5.3) in Oracle Siebel CRM's Siebel Cloud Manager component, exploitable by an unauthenticated remote attacker over HTTP (AV:N/AC:L/PR:N/UI:N) with low confidentiality impact and no integrity or availability impact (C:L/I:N/A:N). No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the input, so there is no public exploit identified at time of analysis. The signals are internally consistent - a network-reachable, low-complexity, no-authentication bug - but the impact is deliberately scoped as 'read access to a subset of accessible data,' which keeps this below a top-tier priority. This is a genuine but bounded risk: the low attack barrier argues for prompt patching on internet-exposed Siebel instances, while the limited, read-only confidentiality impact means it is not a critical emergency absent evidence of active exploitation. No KEV or EPSS data is present, so real-world exploitation likelihood cannot be quantified from the provided intelligence; prioritize based on exposure of the affected component. The 'Authentication Bypass' tag is broadly consistent with the unauthenticated-access nature of the flaw but is not independently confirmed by a vendor classification (CWE is listed as N/A).

An unauthenticated attacker who can reach a Siebel Cloud Manager endpoint over the network sends crafted HTTP requests to the exposed interface and retrieves a subset of Siebel CRM Cloud Applications data they should not be able to access. No credentials, user interaction, or special privileges are required (PR:N/UI:N), though the impact is limited to unauthorized reading of data. No public proof-of-concept exploit was identified in the provided intelligence.