Siebel Cloud Manager CVE-2026-91363

Exploitation targets the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications, versions 22.3 through 26.9, reachable over HTTP; no authentication or user interaction is required (PR:N/UI:N). The dominant limiting factor is AC:H: Oracle's 'difficult to exploit' rating implies the attacker must satisfy conditions outside their direct control (e.g. specific timing, state, or data preconditions), so exploitation is unreliable rather than turnkey. Impact is further bounded to unauthorized read access to only a subset of accessible data, with no write/integrity or availability effect. Realistic exposure requires the Siebel Cloud Manager HTTP interface to be network-accessible to the attacker.

Signals converge on LOW real-world priority despite being network-reachable. The CVSS 3.1 base score is only 3.7, driven by AV:N (HTTP), PR:N (unauthenticated) and UI:N, but critically tempered by AC:H (difficult to exploit) and an impact profile limited to C:L/I:N/A:N - read access to a subset of data, no integrity or availability loss. No EPSS score was supplied, the CVE is not in CISA KEV, and no public exploit is identified, so there is no evidence of active or imminent exploitation. The one tension is the 'Authentication Bypass' tag versus the data: the description characterizes this as unauthenticated unauthorized READ access (information disclosure), not a privilege/authentication bypass, so the tag appears mislabeled and should not drive prioritization. Net: a genuinely low-risk disclosure flaw whose high attack complexity further suppresses mass-exploitation likelihood; patch it in a normal Oracle CPU cycle rather than as an emergency.

A remote, unauthenticated attacker repeatedly sends specially crafted HTTP requests to an internet-reachable Siebel Cloud Manager endpoint, exploiting a difficult-to-trigger condition to read back a limited subset of Siebel CRM Cloud Applications data. Because AC:H indicates non-trivial preconditions or timing/data-dependent behavior, success is unreliable rather than deterministic, and no public proof-of-concept is known at the time of analysis.