EUVD-2026-47061
GHSA-5p7v-jxww-9qjm
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Local infrastructure logon with low-privilege credential required; scope change to additional products confirmed; confidentiality-only impact with no integrity or availability effect stated.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications. While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
AnalysisAI
Local authentication bypass in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component) versions 22.3 through 26.5 allows a low-privileged attacker with infrastructure logon access to gain complete unauthorized read access to all CRM data, including critical records. The scope change in the CVSS vector confirms that exploitation can cascade to impact additional products integrated with the Siebel environment, amplifying data exposure beyond the initial target. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
The vulnerability resides in the Siebel Cloud Manager component - the orchestration and management layer of Oracle Siebel CRM Cloud Applications. Siebel Cloud Manager governs deployment, configuration, and lifecycle operations for cloud-hosted Siebel instances, making it a high-value target for privilege escalation. The 'Authentication Bypass' tag indicates a flaw in the component's access control or authentication enforcement logic, whereby a low-privileged local principal can circumvent controls that should restrict data access. No CWE identifier was provided by Oracle, which is consistent with their historical practice of withholding granular root-cause detail in CPU disclosures. The CVSS scope change (S:C) indicates the exploit crosses a security boundary, likely from the management plane into the Siebel application data plane or integrated downstream systems.
RemediationAI
Apply Oracle's July 2026 Critical Patch Update (CPU), which addresses this vulnerability per the advisory at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched version number was not independently confirmed from the available reference data - consult the CPU advisory directly for the target upgrade version. As a compensating control where patching is not immediately feasible, restrict local logon access to the infrastructure hosting Siebel Cloud Manager to only explicitly authorized administrators, enforcing the principle of least privilege on OS-level accounts; this directly addresses the AV:L/PR:L attack prerequisites. Additionally, audit and reduce the list of principals with any local infrastructure logon rights, and monitor for anomalous data access in Siebel audit logs. Restricting local access may impact legitimate administrative operations and should be coordinated with Siebel operations teams.
More in Siebel Cloud Manager
View allFull application takeover in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.5) allows a low-privileged,
Siebel Cloud Manager in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.5) exposes an authentication bypa
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today