Oracle Siebel CRM EUVD-2026-47054

Exploitation targets the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications running any version from 22.3 through 26.5, and requires only network-level HTTP reachability to that component - per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there are no authentication, user-interaction, or special-configuration prerequisites, so a remote unauthenticated attacker can reach it against affected deployments. The primary limiting factor is exposure: only deployments whose Siebel Cloud Manager HTTP interface is reachable by the attacker (e.g., internet-facing or accessible from the attacker's network segment) are exploitable, and impact is limited to reading data (C:H, I:N, A:N) - no modification or denial of service. Note the 'Authentication Bypass' tag is inferred from vendor tagging; no CWE was provided to confirm the exact mechanism.

Signals are moderately concerning but not emergency-tier. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) describes a network-reachable, low-complexity, unauthenticated attack with no user interaction - the ideal profile for opportunistic scanning - but impact is confined to confidentiality (C:H), with no integrity or availability loss, which is why the base score caps at 7.5 rather than critical. Oracle explicitly labels it 'easily exploitable,' reinforcing low attack complexity. Countervailing factors: no EPSS score, no SSVC decision, and no CWE were supplied, so automatability and exploitation-maturity cannot be independently corroborated. There is no evidence of active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, so this is best treated as a high-priority patch during the normal Oracle Critical Patch Update cycle rather than a drop-everything zero-day. The 'Authentication Bypass' tag paired with C:H suggests exposed data could be broad ('complete access to all Siebel CRM Cloud Applications accessible data' per the description), which raises the stakes for internet-facing deployments.

An attacker locates an internet-reachable Siebel Cloud Manager endpoint and sends crafted HTTP requests that bypass authentication, retrieving CRM data (customer records, account details) without any credentials or user interaction. Because attack complexity is low and no privileges are required, this could be automated across many exposed hosts; however, no public proof-of-concept has been identified at time of analysis.