EUVD-2026-106626
GHSA-c654-cw5r-79x5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged logon to Siebel host
-
ExploitAccess Siebel Cloud Manager component
-
ImpactRead unauthorized subset of application data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already possess a valid low-privileged logon to the infrastructure/host where Siebel CRM Cloud Applications executes (the Siebel Cloud Manager component), on supported versions 22.3 through 26.9. There is no remote or network path and no unauthenticated access - the local attack vector (AV:L) plus required authentication (PR:L) are the primary limiting factors, confining realistic risk to insiders or attackers who have already established a foothold on the host. Impact is bounded to read-only disclosure of a subset of application data; no data modification or service disruption is possible. |
| Impact | This is a genuinely low-priority vulnerability across every available signal. The Oracle-supplied CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) yields a base score of 3.3 (Low): exploitation requires LOCAL access (AV:L) to the infrastructure where Siebel CRM Cloud Applications executes and a pre-existing low-privileged account (PR:L), and the only impact is partial confidentiality (C:L) with no integrity or availability effect. There is no EPSS score provided, the CVE is NOT in CISA KEV, and no public exploit code or POC is referenced - so there is no public exploit identified at time of analysis. No SSVC decision data was supplied. The signals are internally consistent (no conflict between vector and description - both agree on local, authenticated, read-only). The one data discrepancy is the 'Authentication Bypass' tag, which directly contradicts the CVSS vector: PR:L and a 'low privileged attacker with logon' describe an authenticated, not an auth-bypass, flaw. Bottom line: a real but minor information-disclosure issue suitable for routine quarterly patching (fix shipped in Oracle CPU October 2026), not emergency remediation. |
| Exploit ScenarioDerived | A low-privileged user who already has a valid logon to the host/infrastructure running Siebel CRM Cloud Applications (Siebel Cloud Manager component) leverages their local access to read a subset of application data they should not be authorized to see. Because the attack vector is local and requires an existing account, there is no remote or unauthenticated path. No public exploit code is known, so exploitation would require manual effort by an insider or an attacker who has already gained a foothold. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Local users holding a valid low-privileged login on the infrastructure hosting Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3 through 26.9) can read a limited subset of application data they should not be entitled to see. The flaw is confined to a local attack vector with required authentication (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base score 3.3), so it offers no network or unauthenticated path and cannot modify data or disrupt service. There is no public exploit identified at time of analysis and no KEV listing, making this a genuinely low-priority issue whose realistic exposure is limited to insiders or attackers who already hold a foothold on the host. Note that the feed-supplied 'Authentication Bypass' tag is not supported by the assessed vector, which explicitly requires credentials.
RemediationAI
Patch status: patch available per vendor advisory - Oracle addresses this in its October 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpuoct2026.html); the supplied data does not specify a discrete fixed build number, so confirm the exact minimum patched release for your 22.3-26.9 branch against that advisory before closing the finding. Until the CPU is applied, the effective control is host-access hygiene, because the attack requires an existing local login: audit and prune OS and application accounts that can log on to Siebel Cloud Manager hosts, remove shared and service accounts from interactive logon groups, and enforce least privilege and MFA at the bastion or jump host in front of that infrastructure - the trade-off is added friction for operators performing provisioning tasks and possible disruption of automation that relies on shared credentials. Restrict interactive logon on Cloud Manager hosts to a named administrator group via OS-level access controls (for example, limiting SSH/session access to a dedicated admin group), accepting that break-glass procedures will be needed for emergencies. Enable session and query auditing on the Cloud Manager component and forward those logs to the SIEM, alerting on low-privileged accounts retrieving data outside their normal scope; this is detection rather than prevention and generates additional log volume. Monitor the Oracle advisory page for the exact patched version and re-test after upgrade, since a configuration-only mitigation does not remove the underlying flaw.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Siebel Cloud Manager is the management/provisioning layer used to deploy and operate Siebel CRM Cloud Applications, and it runs on infrastructure that operators access with host-level credentials. The assessed vector is purely local (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), meaning the attacker must already be executing code or have an interactive session on the same host as the affected component - there is no remote service reachable over the network for this issue. Scope is unchanged (S:U) and only confidentiality is impacted at a Low level (C:L), with integrity and availability unaffected (I:N/A:N), so the worst realistic outcome is disclosure of a subset of application-accessible data rather than a full compromise or persistence mechanism. No CWE identifier was supplied in the available data; the described behavior - authenticated access returning data beyond the caller's entitlement - is behaviorally consistent with the improper access control / information exposure class (CWE-200 / CWE-639 family), but that classification is inferred from the advisory text rather than confirmed by a vendor-assigned CWE. The 'Authentication Bypass' tag carried by the feed should be treated with caution, since PR:L contradicts the notion of bypassing authentication entirely.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Local access and an existing low-privileged account are required per Oracle's description, giving AV:L and PR:L; impact is limited read-only disclosure, so C:L with I:N/A:N.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 3.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB