Siebel Cloud Manager CVE-2026-91365

Exploitation requires the attacker to have access to the physical/adjacent communication segment attached to the hardware running Siebel CRM Cloud Applications (CVSS AV:A) - it is NOT exploitable over the open internet. No authentication or user interaction is required (PR:N/UI:N), but the attack is explicitly rated difficult (AC:H), meaning success depends on specific, hard-to-control conditions such as network timing or configuration. The affected component is Siebel Cloud Manager in versions 22.3 through 26.9. The primary limiting factors defenders should weigh are the mandatory adjacent-network positioning and the high attack complexity, which together make mass or remote exploitation impractical.

This is a moderate-severity issue (CVSS 3.1 base 5.9) that the signals consistently characterize as hard to exploit and non-remote. The CVSS vector is the strongest available signal: AV:A (adjacent/physical communication segment, NOT internet-facing) combined with AC:H (high attack complexity) substantially constrains real-world exploitability, even though PR:N and UI:N mean no authentication or victim interaction is needed once an attacker is on the right network segment. Impact is partial-to-high on confidentiality (C:H - full read access to Siebel data) but only limited on integrity (I:L) and none on availability (A:N). No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided, so there is no evidence of active exploitation - no public exploit identified at time of analysis. The absence of KEV/EPSS is consistent with a vendor-reported (Oracle secalert) advisory-stage flaw rather than a widely weaponized bug. One conflict worth noting: the input Tags include 'Authentication Bypass,' but the description describes an unauthenticated adjacent-network compromise rather than a bypass of an authentication control - treat the tag as unverified. Net assessment: a real but LOWER-priority issue for most defenders because the adjacent-access requirement and high complexity make it unsuitable for broad or automated exploitation; prioritize patching for Siebel hosts on shared or less-trusted network segments.

An attacker positioned on the same physical/adjacent network segment as the Siebel CRM Cloud Applications host (e.g., a compromised adjacent server, rogue device, or insider on the data-center LAN) manipulates traffic to the Siebel Cloud Manager component to gain unauthenticated read access to sensitive CRM data and make limited unauthorized modifications. Exploitation is rated high-complexity, implying specific timing, configuration, or network conditions must be met, and no public exploit code is known. This cannot be performed directly from the internet.