Oracle Siebel CRM EUVD-2026-105855

Exploitation targets the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications versions 22.3 through 26.9 and requires network access to the LDAP attack surface of that component; no authentication (PR:N) and no user interaction (UI:N) are needed. The primary limiting factor is high attack complexity (AC:H): Oracle explicitly rates this 'difficult to exploit,' indicating success depends on specific conditions beyond the attacker's direct control (e.g., particular LDAP configuration, timing, or environmental state) rather than a default, repeatable request. Impact is confined to confidentiality, so a successful attack yields data disclosure only, not modification or disruption. Restricting network exposure of the Siebel Cloud Manager/LDAP interface reduces realistic risk.

This is a moderate-priority issue that should not be treated as an emergency despite the network-reachable, unauthenticated profile. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, base 5.9) shows the two decisive signals pulling against each other: PR:N and AV:N make it reachable by any unauthenticated attacker over the network via LDAP, but AC:H ('difficult to exploit' per Oracle's own wording) means success depends on conditions outside the attacker's routine control, which substantially lowers real-world likelihood. Impact is confidentiality-only (C:H, I:N, A:N): disclosure of or complete read access to Siebel CRM Cloud Applications data, with no integrity or availability loss and no scope change (S:U). No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or at-scale exploitation - the AC:H plus absence of exploit signals together argue this is a latent risk rather than an imminent one. Note a metadata conflict: the input Tags label this 'Authentication Bypass,' but the description characterizes it as unauthenticated LDAP-based data compromise, not a described authentication-bypass mechanism - verify the exact flaw class against Oracle's CPU advisory. Prioritize patching in the normal Oracle quarterly cycle, ahead of purely local or lower-impact CPU items but behind any easily-exploitable (AC:L) network-facing criticals.

A remote, unauthenticated attacker with network reach to the Siebel Cloud Manager component sends crafted LDAP interactions to the exposed Siebel CRM Cloud Applications instance and, after satisfying the difficult-to-meet preconditions implied by AC:H, reads critical application data up to complete access to all accessible data. No public exploit code was identified at time of analysis, and the high attack complexity means a reliable exploit would require specific environmental conditions rather than a simple one-shot request.