Oracle Siebel CRM CVE-2026-91371

Requires network access over HTTP to a running Siebel Cloud Manager component within Oracle Siebel CRM Cloud Applications, versions 22.3 through 26.9; no authentication, credentials, or user interaction are needed (PR:N/UI:N), so default-configuration, network-reachable instances are exploitable. The primary limiting factors are network reachability of the Cloud Manager endpoint (internal segmentation or lack of internet exposure substantially reduces exposure) and the running of an affected version in the 22.3-26.9 range; impact is confined to unauthorized read access to a subset of data, so there is no integrity or availability exposure. No special product feature toggle or non-default configuration is cited by Oracle as a precondition.

Oracle rates this CVSS 3.1 5.8 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N - network-reachable over HTTP, low complexity, no privileges and no user interaction, with a scope change and confidentiality-only (Low) impact. The combination of unauthenticated network access and low attack complexity makes this trivially reachable, which is the most concerning signal; however, impact is limited to unauthorized read access to a subset of data, with no integrity or availability impact, which caps the score at Medium. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or weaponization - this is a high-reachability but limited-impact disclosure flaw rather than a confirmed in-the-wild priority. The scope change (S:C) indicates the vulnerability in Siebel Cloud Manager can affect additional products/data beyond its own security authority, which modestly raises real-world concern and warrants prioritizing patching for internet-exposed Siebel Cloud Manager instances despite the Medium base score. The 'Authentication Bypass' tag is not corroborated by the description, which describes unauthenticated information disclosure rather than a bypass of an auth mechanism - treat that tag with caution and verify against the Oracle CPU advisory.

An unauthenticated attacker with network access to an internet-exposed or internally reachable Siebel Cloud Manager HTTP endpoint sends a crafted request that returns a subset of Siebel CRM Cloud Applications data the attacker should not be able to read. Because of the scope change, the disclosed data may extend to additional products integrated with the Cloud Manager. No public exploit code was identified at time of analysis, and no user interaction or credentials are required.