Siebel Cloud Manager CVE-2026-91361

The affected component is Siebel Cloud Manager within Oracle Siebel CRM Cloud Applications, versions 22.3 through 26.9. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation requires only network access over HTTP to a reachable Siebel Cloud Manager instance, with no authentication and no user interaction - i.e., it works against default configurations of the exposed service. The primary limiting factor is network exposure: the risk is realistic only where the Siebel Cloud Manager HTTP interface is reachable by the attacker (internet-facing or attacker-adjacent network); instances restricted to internal/trusted networks substantially reduce exposure. Impact is further bounded to integrity of 'some' accessible data, with no read access or availability effect.

This is a moderate-severity integrity flaw, not a top-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) indicates network-reachable, low-complexity, unauthenticated exploitation requiring no user interaction - favorable conditions for an attacker - but the only impact is LOW integrity (unauthorized update/insert/delete to SOME accessible data), with no confidentiality or availability impact and no scope change. The real-world risk is tempered by the limited blast radius: an attacker can tamper with a subset of Siebel CRM Cloud data but cannot read data, cause outages, or pivot beyond the vulnerable component. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT on CISA KEV and no POC was indicated, so there is no public exploit identified at time of analysis. The 'Authentication Bypass' tag is directionally consistent with the PR:N vector (unauthenticated write access), but the input provides no CWE and no technical root-cause detail to confirm the mechanism - verify specifics against the Oracle October 2026 CPU. Overall: patch within a normal cycle for internet-exposed Siebel deployments, but this does not warrant emergency action absent further exploitation signals.

A remote, unauthenticated attacker sends crafted HTTP requests to an internet-reachable Siebel Cloud Manager endpoint and, exploiting missing or bypassed authorization, performs unauthorized insert/update/delete operations against a subset of Siebel CRM Cloud Applications data. No user interaction or credentials are required, but impact is confined to data integrity - no data disclosure or service disruption. No public proof-of-concept was identified at time of analysis.