Oracle Siebel CRM EUVD-2026-47045

Exploitation requires network HTTP access to the Siebel Cloud Manager component of Siebel CRM Cloud Applications and, per the CVSS vector (PR:L), a valid low-privilege authenticated session on the platform - no user interaction is needed (UI:N) and attack complexity is low (AC:L). Impact reaches beyond the initial component due to the scope change (S:C), affecting additional Siebel CRM Cloud Applications data. Limiting factors: only versions 22.3 through 26.5 are affected; the attacker must possess at least low-privilege access under the CVSS rating; and impact is confined to confidentiality (data disclosure), with no integrity or availability effect. NOTE: the EUVD 'Authentication Bypass' tag conflicts with PR:L - if an unauthenticated bypass is confirmed by Oracle, the authentication prerequisite would not apply; verify with the vendor.

The signals point to a genuine but not top-tier emergency priority. CVSS 3.1 is 7.7 (High), driven by network vector (AV:N), low attack complexity (AC:L), no user interaction (UI:N), a scope change (S:C) and high confidentiality impact (C:H); however PR:L means the attacker must already hold some valid low-privilege access, and there is no integrity or availability impact (I:N/A:N) - this is data disclosure, not RCE or destruction. No EPSS score, no SSVC decision, no POC, and no CISA KEV listing were provided, so there is no evidence of active or automatable exploitation (no public exploit identified at time of analysis). The EUVD 'Authentication Bypass' tag appears to conflict with the CVSS PR:L, which asserts privileges ARE required; this must be verified with Oracle because it changes whether a fully unauthenticated attacker can exploit it. Net: treat as a High-priority item in the July 2026 Oracle CPU cycle, especially for internet-exposed Siebel Cloud deployments, but not a drop-everything zero-day given the absence of exploitation signals.

An attacker holding a low-privilege Siebel Cloud account (or, per the disputed authentication-bypass tag, a minimal foothold) sends crafted HTTP requests to the Siebel Cloud Manager interface and, exploiting the access-control gap, retrieves data belonging to other users or tenants across the connected Siebel CRM Cloud Applications. With no user interaction and low complexity, the requests can be scripted once the flaw is understood; no public POC has been identified at time of analysis.