Oracle Siebel CRM CVE-2026-91370

Exploitation requires network access to the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications on affected versions 22.3 through 26.9, reachable over HTTP; per CVSS PR:N/UI:N/AC:L no authentication, user interaction, or special configuration is stated as required. The primary limiting factor is reachability of the Siebel Cloud Manager endpoint - deployments that keep this component behind a VPN, WAF, or restricted network segment rather than internet-exposed substantially reduce real-world exposure. Impact is inherently limited to read access to a subset of data (C:L), so this is a disclosure boundary, not a path to code execution or data modification.

This is a moderate-severity information disclosure flaw whose signals point consistently toward lower real-world urgency than a 'network/unauthenticated' summary might suggest. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) confirms remote, unauthenticated, low-complexity access, but impact is confined to confidentiality only (C:L) with no integrity or availability effect, and Oracle itself scopes success to 'unauthorized read access to a subset of accessible data' - not full compromise. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization; exploitation status is 'no public exploit identified at time of analysis.' The 'Authentication Bypass' tag conflicts somewhat with the official description, which characterizes the issue as unauthorized read access rather than a full authentication bypass - this should be verified against Oracle's advisory before treating it as a credential/session bypass. Net assessment: a genuine but limited data-exposure issue that warrants patching on Oracle's normal CPU cadence rather than emergency response, absent new exploitation signals.

An unauthenticated attacker with network reach to an internet-facing or internally exposed Siebel Cloud Manager endpoint sends crafted HTTP requests to retrieve a subset of Siebel CRM Cloud Applications data they should not be able to read. No public exploit code is identified at the time of analysis, and the low attack complexity (AC:L) means no special timing or race conditions are required once the endpoint is reachable.