Oracle Siebel CRM EUVD-2026-105858

Exploitation requires the attacker to already hold a low-privileged authenticated account (PR:L) on Siebel CRM Cloud Applications and network HTTP access to the Siebel Cloud Manager component. The high attack complexity (AC:H) indicates success depends on conditions outside the attacker's direct control - such as specific timing, race conditions, or environment/configuration state - rather than a reliable one-shot request. Impact is strictly limited to reading a subset of accessible data (C:L); no data modification (I:N) or service disruption (A:N) is possible. These factors - mandatory authentication plus difficult, non-deterministic exploitation - substantially limit real-world risk despite the network attack vector.

This is a genuinely low-priority vulnerability across nearly every signal. The vendor-supplied CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N = 3.1 Low) describes a network-reachable flaw that is HARD to exploit (AC:H), requires existing low-level privileges (PR:L), and yields only a partial loss of confidentiality (C:L) with no integrity or availability impact. No EPSS score was provided; the CVE is NOT in CISA KEV and no POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC decision data supplied. The signals are internally consistent - a low CVSS driven by high attack complexity and required authentication aligns with a minor information-disclosure issue rather than a widespread threat. One discrepancy worth noting: the input Tags include 'Authentication Bypass,' which conflicts with both the description (an authenticated low-privileged read) and the CVSS vector (PR:L, C:L only) - this appears to be a mislabel and should not drive prioritization. Overall this is a high-noise/low-real-risk finding: patch during normal Oracle CPU cycles, not as an emergency.

A low-privileged but authenticated user of Siebel CRM Cloud Applications crafts specific HTTP requests to the Siebel Cloud Manager component to read a limited subset of data they are not authorized to see. The attack is difficult (AC:H), requiring specific timing, configuration, or conditions beyond the attacker's control, and no public exploit code is known to exist.