Siebel CRM EUVD-2026-106622

Exploitation requires a valid high-privileged logon to the operating-system/infrastructure host where Siebel CRM Cloud Applications executes (AV:L, PR:H) and targets the Siebel Cloud Manager component specifically; affected deployments run Siebel CRM Cloud Applications versions 22.3 through 26.9. Limiting factors that sharply reduce realistic risk: the attacker must already possess high privileges on the host, the attack has HIGH complexity (AC:H) implying race conditions or specific preconditions outside the attacker's direct control, no user interaction is involved (UI:N), and only confidentiality is at stake (no data modification or service disruption). It is not remotely exploitable and not exploitable by unauthenticated or low-privileged users.

This is a low-priority, high-severity-on-paper-but-low-real-risk issue. The CVSS 3.1 base score is only 4.1 (MEDIUM), and the vector (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) makes the barrier to exploitation substantial: an attacker needs LOCAL access (AV:L) with a valid logon to the infrastructure where Siebel CRM Cloud Applications runs, must already hold HIGH privileges (PR:H), and must overcome HIGH attack complexity (AC:H). Impact is confined to confidentiality (C:H) - there is no integrity or availability impact (I:N/A:N) and no scope change (S:U). There is NO EPSS score, NO CISA KEV listing, and NO public POC provided in the input, all of which align with the low likelihood of opportunistic or widespread exploitation. One signal conflicts with the technical reality: the input Tags include 'Authentication Bypass', which contradicts the vector requiring PR:H (an already highly-privileged, authenticated local actor) - this is NOT an unauthenticated auth-bypass and the tag appears mislabeled; the actual flaw is a privilege/confidentiality exposure usable only by an insider or an attacker who has already compromised a privileged account. Net: real-world risk is low and primarily an insider/post-compromise concern, not an internet-facing emergency.

An attacker who has already obtained a high-privileged login on the host infrastructure running Siebel CRM Cloud Applications (e.g., a malicious administrator or an attacker who pivoted onto the server after an earlier compromise) leverages a difficult-to-exploit local weakness in the Siebel Cloud Manager component to read critical application data. No public exploit code is identified at time of analysis, and the HIGH attack complexity plus required local high privileges make this an insider or post-exploitation scenario rather than a remote smash-and-grab.