Siebel Cloud Manager EUVD-2026-105860

Exploitation requires the attacker to possess a low-privileged account with logon access to the infrastructure/host where Siebel CRM Cloud Applications executes, and specifically targets the Siebel Cloud Manager component on affected versions 22.3 through 26.9. There is no remote network vector (AV:L is local) and no unauthenticated path, so the limiting factors are: (1) prior local logon access to the Siebel host, and (2) a valid low-privilege credential on that infrastructure. No special non-default configuration or user interaction is cited in the description; the primary barriers are the local-access and authentication prerequisites, which confine realistic exploitation to insiders or attackers who have already established a foothold.

This is a moderate, not top-priority, issue. The CVSS 3.1 base score is 5.5 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - meaning exploitation requires LOCAL access (AV:L) to the infrastructure where Siebel CRM Cloud Applications runs, plus an existing low-privileged authenticated account (PR:L). The impact is confidentiality-only (C:H, I:N, A:N): an attacker can read critical/all accessible Siebel data but cannot modify it or affect availability. No EPSS score was supplied, the CVE is NOT on CISA KEV, and no public exploit code (POC) was provided in the intelligence set - so the real-world exploitation signal is currently absent. The local attack vector plus authentication requirement substantially limits the realistic attacker population to insiders or an attacker who has already gained a foothold on the host, which argues against widespread opportunistic exploitation. CONFLICTING SIGNAL: the input Tags include 'Authentication Bypass', but the CVSS vector (PR:L) and the description ('low privileged attacker with logon') both indicate valid authentication IS required - this is an authenticated local information-disclosure flaw, not an authentication bypass; the tag appears mislabeled and should be verified against the Oracle CPU advisory. Overall this is a genuine but lower-urgency confidentiality risk best prioritized by organizations running affected Siebel versions with many local/shared-host accounts.

An attacker who already holds a low-privileged account with logon access to the server/infrastructure hosting Siebel CRM Cloud Applications (e.g., a malicious insider or an actor who has pivoted onto the host) abuses the Siebel Cloud Manager component locally to read confidential Siebel data beyond their authorization. No user interaction is required (UI:N) and the attack complexity is low (AC:L), but no public exploit code was identified in the provided intelligence.