EUVD-2026-106614
GHSA-fhvp-j9x2-h7w4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege Siebel account
-
ExploitSend crafted HTTP request to Siebel Cloud Manager
-
ExecutionBypass data access controls
-
ImpactRead/exfiltrate critical application data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privilege account on an affected Siebel CRM Cloud Applications tenant (versions 22.3-26.9) and network/HTTP reachability to the Siebel Cloud Manager component. No user interaction is needed and attack complexity is low, but the PR:L requirement means a fully unauthenticated attacker cannot exploit it - credentials (or a provisioned low-tier user) are the key limiting factor, so exposure scales with how broadly low-privilege accounts are granted and whether Siebel Cloud Manager is internet-reachable. Impact is limited to data confidentiality (no integrity or availability effect). |
| Impact | This is a moderate-severity confidentiality flaw (CVSS 3.1 base 6.5, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) in Oracle Siebel CRM Cloud Applications. The vector shows a genuinely remote, low-complexity attack requiring only low privileges (PR:L) and no user interaction, with a pure confidentiality impact (C:H, I:N, A:N) and unchanged scope. There is no EPSS score, no CISA KEV listing, and no public POC provided in the input, so there is no evidence of active or imminent exploitation - this reads as a credentialed-access data-exposure issue rather than an unauthenticated internet-facing emergency. Note a signal conflict: the 'Authentication Bypass' tag implies no credentials are needed, but both the description ('low privileged attacker') and the CVSS vector (PR:L) require an authenticated low-privilege account, so the tag appears mislabeled - treat this as an authenticated access-control / data-disclosure flaw, not a true pre-auth bypass. Because exploitation needs valid (even low-tier) credentials and only leaks data, real-world priority is moderate: patch in the normal Oracle CPU cycle, prioritizing internet-exposed Siebel Cloud Manager instances and tenants where low-privilege accounts are widely provisioned. |
| Exploit ScenarioDerived | An attacker holding a low-privilege account on a Siebel CRM Cloud Applications tenant sends crafted HTTP requests to the Siebel Cloud Manager component and obtains unauthorized read access to critical data belonging to the application or other users. Because the attack is network-based with low complexity and no user interaction (AV:N/AC:L/UI:N), it can be automated once valid low-tier credentials are obtained. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Oracle Siebel CRM Cloud Applications 22.3 through 26.9 can expose sensitive tenant data, potentially all data accessible to that tenant, to an authenticated low-privilege user through the Siebel Cloud Manager component. The issue is remotely reachable over HTTP with low attack complexity and no user interaction, and impact is confidentiality-only (CVSS 3.1 base 6.5; PR:L). No public exploit identified at time of analysis.
RemediationAI
Apply the Oracle Critical Patch Update October 2026 update for Siebel CRM Cloud Applications (Siebel Cloud Manager) as referenced at https://www.oracle.com/security-alerts/cpuoct2026.html; the provided data does not state an exact fixed build, so confirm the tenant is on a release that includes the CPU October 2026 fix rather than assuming an unaffected version. Until then, reduce exposure by restricting HTTP access to Siebel Cloud Manager to trusted administrative networks or VPN ranges, which lowers remote reachability but can block legitimate cloud-management workflows if applied too broadly, and by auditing/removing unused low-privilege tenant accounts and enforcing least privilege, which shrinks the PR:L attack surface but may require role redesign and user retraining. Monitor Oracle's advisory for the precise patched version and any cloud-side automatic remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Siebel CRM Cloud Applications is a multi-tenant SaaS CRM platform; Siebel Cloud Manager is the management/provisioning component exposed over HTTP. The vulnerability is an access-control/data-exposure flaw in that component: a user who already holds a low-privilege tenant account can read data beyond their intended authorization scope, but cannot modify or disrupt it (C:H/I:N/A:N). The provided data assigns no CWE and no CPE strings; EUVD identifies the affected range as Siebel CRM Cloud Applications 22.3 ≤26.9. The supplied tags include Authentication Bypass and Oracle, while the authoritative CVSS vector is AV:N/AC:L/PR:L/UI:N/S:U, so the practical gate is a valid low-tier account plus HTTP reachability to Siebel Cloud Manager rather than fully unauthenticated access.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network HTTP vector with low complexity and no user interaction; a low-privilege account is required (PR:L), scope unchanged, and impact is confidentiality-only (C:H, I:N, A:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB