EUVD-2026-47044
GHSA-32wg-3w3c-pp2m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Siebel Cloud Manager endpoint
-
DeliverySend crafted unauthenticated HTTP request
-
ExploitBypass access control on endpoint
-
ExecutionRead critical CRM application data
-
ImpactExfiltrate customer and business data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target must run Siebel CRM Cloud Applications version 22.3 through 26.5 with the Siebel Cloud Manager component reachable over HTTP from the attacker's network position. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there are no special conditions - remote unauthenticated exploitation against network-reachable Siebel Cloud Manager, with no authentication, no user interaction, and low attack complexity. The primary limiting factor is network reachability: deployments where Cloud Manager is not exposed to untrusted networks (internal-only, VPN-gated, or WAF-fronted with enforced authentication) substantially reduce realistic exposure, and impact is limited to data disclosure with no integrity or availability effect. |
| Impact | The signals consistently indicate a genuinely network-exploitable confidentiality risk: CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N marks it remotely reachable, low-complexity, unauthenticated, and requiring no user interaction, which is why Oracle scored it 7.5. However, corroborating exploitation signals are absent - no EPSS probability was provided, the flaw is not in CISA KEV (no confirmed active exploitation), and no public proof-of-concept is identified - so this is a high-severity issue by design metrics rather than a confirmed under-attack scenario. Impact is bounded to confidentiality only (no integrity or availability loss), so while exposure of CRM customer and business data could be serious, this is not a full-compromise issue. There is no conflict between the CVSS vector and the description (both agree on unauthenticated network access), but the missing CWE and EPSS mean the exploitation-likelihood picture is incomplete and should be treated as elevated but unquantified. |
| Exploit ScenarioDerived | An attacker on the network sends crafted HTTP requests directly to an internet-exposed Siebel Cloud Manager endpoint and, exploiting the missing authentication enforcement, retrieves sensitive CRM data such as customer records and business information without any credentials. Because attack complexity is low and no user interaction is required, the request can be scripted and repeated at scale; no public POC is currently identified, so exploitation would require an attacker to independently develop the request pattern. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Unauthorized data access in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3 through 26.5) lets a remote, unauthenticated attacker reach and read critical application data over HTTP. Oracle rates this CVSS 3.1 7.5 with confidentiality-only impact, and the intelligence tags flag it as an authentication-bypass class issue, so attackers can obtain complete access to all data accessible to the affected applications without credentials. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
RemediationAI
Apply the fixes delivered in the Oracle Critical Patch Update of July 2026, which addresses this issue for Siebel CRM Cloud Applications; the advisory and patch matrix are at https://www.oracle.com/security-alerts/cpujul2026.html (Patch available per vendor advisory - an exact standalone fix build is not enumerated in the provided data beyond the CPU release). Because exploitation is unauthenticated over HTTP, until the CPU is applied restrict network exposure of Siebel Cloud Manager endpoints to trusted networks or a VPN, front the application with a WAF or reverse proxy that enforces authentication and blocks unauthenticated access to management paths, and monitor HTTP access logs for anomalous requests to Cloud Manager URLs; note that tightening network access may disrupt legitimate remote administration or integrations and should be validated against operational needs. Prioritize patching for any internet-facing Siebel deployments.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Siebel CRM is Oracle's enterprise customer relationship management suite; the affected component, Siebel Cloud Manager, is the cloud provisioning and management layer that orchestrates and exposes the Cloud Applications over HTTP. The 'Authentication Bypass' tag indicates the root cause is a failure to properly enforce access control on network-facing endpoints, aligning with the confidentiality-only CVSS impact (C:H/I:N/A:N) - an attacker gains read access to protected data without altering integrity or availability. Oracle did not assign a CWE (listed N/A), so the precise weakness class (for example, missing authentication for a critical function or improper authorization) is not formally categorized in the source data, but the vector and tag point to a broken-access-control condition.
Know when Siebel Crm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated HTTP-reachable auth bypass justifies AV:N/AC:L/PR:N/UI:N; impact is data disclosure only, so C:H with I:N and A:N.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Executive ViewAI
Oracle Siebel CRM Cloud Manager (versions 22.3-26.5) contains an authentication-bypass vulnerability allowing remote, unauthenticated attackers to read all application data without credentials. Organizations using Siebel Cloud face immediate risk of complete confidential data exposure-including customer records and business intelligence-with cascading regulatory and reputational consequences. The vulnerability is exploitable but no public exploit code has been identified at time of analysis.
Restrict HTTP access via firewall and Web Application Firewall to approved networks and IP ranges only; enable comprehensive audit logging of all data access, API calls, and authentication attempts; implement network segmentation isolating Siebel Cloud systems from general corporate infrastructure; deploy continuous monitoring for abnormal queries and data exfiltration patterns; enforce credential rotation for all accounts with Siebel access; and disable non-critical data export and API endpoints where operationally feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Siebel Crm
View allPrivilege-based takeover of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) is possible via the Siebel
Full compromise of Oracle Siebel CRM Integration (Open Integration component) is achievable by a low-privileged, network
Privilege escalation to full takeover in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions
Unauthenticated remote compromise of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) is possible throu
Full application takeover in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 throug
Full compromise of Oracle Siebel CRM Integration (Open Integration component) is possible by an unauthenticated remote a
Remote takeover of Oracle Siebel CRM Administration is possible via its Data Archival component, where an unauthenticate
Authentication bypass in the Server Infrastructure component of Oracle Siebel CRM Deployment (supported versions 17.0 th
Authentication bypass in the Server Infrastructure component of Oracle Siebel CRM Deployment (versions 17.0 through 26.7
Unauthenticated attackers with network reachability to the Siebel CRM Open UI SOAP interface can bypass authentication i
Full system takeover in Oracle Siebel CRM Deployment's Server Infrastructure component is achievable by any low-privileg
Full application takeover in Oracle Siebel CRM Cloud Applications (versions 22.3-26.6) is achievable by any low-privileg
Exploit-DB