Siebel Cloud Manager EUVD-2026-105856

Exploitation requires the attacker to have network access to the physical communication segment attached to the hardware running Siebel CRM Cloud Applications (CVSS AV:A, Adjacent) - i.e., presence on the same local/physical network segment, not routable internet access - specifically targeting the Siebel Cloud Manager component in versions 22.3 through 26.9. No authentication and no user interaction are needed (PR:N/UI:N). The key LIMITING factors are: (1) the Adjacent-only attack vector, which blocks direct remote-internet exploitation and requires prior positioning on the local segment, and (2) high attack complexity (AC:H), meaning the attacker must defeat additional non-default or race/timing conditions that are not reliably reproducible. Impact is bounded to full read of Siebel CRM data plus limited write (insert/update/delete of some data); there is no availability impact.

This is a moderate-severity issue (CVSS 3.1 base 5.9) that the signals collectively argue AGAINST treating as an urgent, broadly exploitable priority. The provided CVSS vector (AV:A/AC:H/PR:N/UI:N) is the decisive constraint: exploitation requires AV:A (Adjacent) access - per Oracle's own wording, 'access to the physical communication segment attached to the hardware' - combined with AC:H (high attack complexity), meaning the attacker must already be positioned on the same local/physical network segment and overcome non-trivial conditions. No authentication is required (PR:N), and impact is scoped to confidentiality (C:H) with limited integrity (I:L) and no availability impact (A:N). No EPSS score, CISA KEV listing, POC, or SSVC data was supplied in the input, so no exploitation-probability or automatability signal is available to raise or lower the base assessment - absence of these is not evidence of safety, but there is nothing here indicating active or automated exploitation. Net: a genuine data-confidentiality exposure for organizations where an attacker could plausibly reach the adjacent segment (e.g., a compromised host in the same datacenter VLAN), but the Adjacent+High-complexity gating makes mass or remote-internet exploitation unlikely, so this ranks as a routine-to-moderate patch priority rather than an emergency. Note also a labeling tension: the input Tags include 'Authentication Bypass,' but Oracle's description frames this as adjacent-network compromise rather than a classic auth-bypass - verify the mechanism against Oracle's CPU advisory before relying on that characterization.

An attacker who has gained a foothold on the same physical/adjacent network segment as the Siebel CRM Cloud Applications host (for example, a compromised adjacent server or a rogue device on the datacenter VLAN) targets the Siebel Cloud Manager component and, after satisfying the high-complexity conditions, reads critical Siebel CRM data and makes limited unauthorized modifications without any credentials. No public exploit code is identified at time of analysis, and the AV:A / AC:H profile means this is a positioned, targeted effort rather than opportunistic remote scanning.