Siebel Cloud Manager CVE-2026-91364

Exploitation requires the attacker to have access to the physical communication segment (adjacent network, AV:A) attached to the hardware executing Siebel CRM Cloud Applications - remote internet-based exploitation is NOT possible. The flaw is in the Siebel Cloud Manager component across versions 22.3 through 26.9. While no authentication is needed (PR:N) and no user interaction is required (UI:N), exploitation is explicitly rated difficult (AC:H), implying dependence on specific timing, state, or non-trivial preconditions. The key limiting factors are the mandatory local-segment positioning and the high attack complexity, which together make opportunistic or internet-wide exploitation infeasible.

This is a moderate-severity (CVSS 6.8) flaw whose real-world risk is substantially constrained by its attack vector. The CVSS vector (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) requires adjacent-network access - specifically, per the description, access to the physical communication segment attached to the hardware running Siebel CRM Cloud Applications - and is explicitly rated as 'Difficult to exploit' (AC:H). Although PR:N makes it unauthenticated, the adjacency requirement plus high complexity sharply narrows the attacker population to someone already positioned on the local segment. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The confidentiality and integrity impacts are High (C:H/I:H) with no availability impact (A:N). Net assessment: this is a legitimate but lower-priority issue for most defenders - high theoretical impact offset by a demanding access precondition and no exploitation signal. Patch during normal Oracle CPU cycles rather than as an emergency. Note the 'Authentication Bypass' tag conflicts with the described mechanism (an adjacent-segment memory/protocol-style compromise, not a credential bypass) - verify the vulnerability class with Oracle.

An attacker who has gained a foothold on the same physical/local network segment as the Siebel Cloud Manager host crafts specially-timed or malformed adjacent-network traffic to the service. Because exploitation is rated high-complexity, success likely depends on winning a race condition or meeting specific timing/state preconditions, but if achieved the attacker gains read and write access to critical Siebel CRM data without authentication. No public exploit code is identified at time of analysis.