EUVD-2026-106616
GHSA-pwff-r3c2-wrrf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Siebel Cloud Manager over HTTP
-
ExploitSend crafted unauthenticated request
-
ImpactRead subset of CRM application data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Siebel Cloud Manager component of an affected Oracle Siebel CRM Cloud Applications deployment (versions 22.3 through 26.9) over HTTP; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special configuration are stated as prerequisites, so default deployments appear exploitable. The primary limiting factor is exposure: risk is concentrated on instances whose Siebel Cloud Manager HTTP interface is reachable by the attacker (e.g., internet-facing or accessible from an attacker-controlled network segment), and the impact is bounded to read access to only a subset of accessible data, with no write or availability consequence. |
| Impact | This is a moderate-severity information-disclosure flaw (CVSS 3.1 base 5.3) in Oracle Siebel CRM Cloud Applications via the Siebel Cloud Manager component. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms a network-reachable, low-complexity, unauthenticated vector requiring no user interaction, which raises exploitability, but impact is limited to unauthorized read access to a SUBSET of data (C:L, with I:N and A:N), so there is no integrity or availability impact. No EPSS score, CISA KEV listing, POC, or SSVC data was provided in the input, so there is no evidence of active exploitation or published exploit code - exploitation probability cannot be quantified from the available signals. The 'Authentication Bypass' input tag is somewhat at odds with the description, which characterizes the issue as unauthorized read access by an unauthenticated attacker rather than a bypass of an existing authentication boundary - verify the precise mechanism with Oracle. Net assessment: a real but non-critical priority - patch during the normal Oracle CPU cycle; the unauthenticated network vector warrants attention for internet-exposed Siebel Cloud Manager instances, but the confidentiality-only, partial-data impact keeps this below the urgency of code-execution or full-data-exposure flaws. |
| Exploit ScenarioDerived | An unauthenticated attacker with network access sends a crafted HTTP request to an exposed Siebel Cloud Manager endpoint and, because no authentication or user interaction is required, retrieves a subset of Siebel CRM Cloud Applications data they should not be able to read. No public exploit code or active exploitation is identified in the provided data, and the impact is limited to reading a partial data set rather than modifying data or disrupting service. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Unauthenticated HTTP requests to the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.9) can return a limited subset of application data to any attacker who can reach that interface, producing a confidentiality-only impact rated CVSS 3.1 base 5.3. The vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) requires no credentials, no user interaction, and no special configuration, so real-world exposure is governed almost entirely by whether Cloud Manager is network-reachable rather than by privilege level. No public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle addresses the flaw in its October 2026 Critical Patch Update advisory.
RemediationAI
Apply the fix published in Oracle's October 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpuoct2026.html), which covers Siebel CRM Cloud Applications 22.3 through 26.9; the exact patched build is documented in the advisory rather than in this dataset. Because exploitability depends solely on reachability of the unauthenticated HTTP interface, the most effective interim control is to restrict access to Siebel Cloud Manager to trusted administrative networks - place it behind a VPN, an authenticating reverse proxy, or IP-allowlisted security groups/firewall rules - accepting the trade-off that legitimate administrators must route through the additional access layer. For deployments where Cloud Manager must remain externally reachable, front it with a WAF or reverse proxy that enforces authentication on all management paths and review HTTP access logs for unauthenticated requests that return application data; note that no vendor workaround is described in the provided data, and Oracle CPU patch downloads typically require a My Oracle Support account.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Siebel Cloud Manager is the provisioning and lifecycle-management tier used to deploy and administer Oracle Siebel CRM Cloud Applications environments; it exposes an HTTP management interface that is normally confined to administrative networks but in some deployments is internet-facing or reachable from broader segments. The defect is an access-control weakness on that HTTP surface - the source classification tags it as an authentication bypass, which is consistent with the PR:N vector - allowing an unauthenticated remote party to read data the endpoint should not expose to unprivileged callers. No CWE identifier was supplied by the CNA, so the weakness cannot be mapped to a more specific root-cause class than broken authentication/authorization on a management endpoint. The CVSS scope remains unchanged (S:U) and the impact is confined to confidentiality (C:L) with no integrity or availability consequence, meaning an attacker gains read-only visibility into a subset of accessible data rather than control of the platform.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Description confirms unauthenticated (PR:N) low-complexity HTTP access (AV:N/AC:L) yielding partial confidentiality disclosure only, so C:L with I:N and A:N.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB