Siebel Cloud Manager
Monthly
Full application takeover in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.5) allows a low-privileged, network-based attacker to compromise the product via HTTP through the Siebel Cloud Manager component. Because the flaw carries a scope change, successful exploitation can pivot beyond Siebel to significantly impact additional connected products, driving the rare CVSS 9.9 rating. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and low privilege bar make it a high-priority patch item.
Siebel Cloud Manager in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.5) exposes an authentication bypass that permits low-privileged local users to read and modify CRM data beyond their authorized scope. The flaw requires an existing logon to the infrastructure hosting the application, constraining the attack surface to internal or compromised users rather than remote internet-based attackers. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; the CVSS 4.4 Medium rating reflects these limiting factors.
Local authentication bypass in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component) versions 22.3 through 26.5 allows a low-privileged attacker with infrastructure logon access to gain complete unauthorized read access to all CRM data, including critical records. The scope change in the CVSS vector confirms that exploitation can cascade to impact additional products integrated with the Siebel environment, amplifying data exposure beyond the initial target. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Full application takeover in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.5) allows a low-privileged, network-based attacker to compromise the product via HTTP through the Siebel Cloud Manager component. Because the flaw carries a scope change, successful exploitation can pivot beyond Siebel to significantly impact additional connected products, driving the rare CVSS 9.9 rating. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and low privilege bar make it a high-priority patch item.
Siebel Cloud Manager in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.5) exposes an authentication bypass that permits low-privileged local users to read and modify CRM data beyond their authorized scope. The flaw requires an existing logon to the infrastructure hosting the application, constraining the attack surface to internal or compromised users rather than remote internet-based attackers. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; the CVSS 4.4 Medium rating reflects these limiting factors.
Local authentication bypass in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component) versions 22.3 through 26.5 allows a low-privileged attacker with infrastructure logon access to gain complete unauthorized read access to all CRM data, including critical records. The scope change in the CVSS vector confirms that exploitation can cascade to impact additional products integrated with the Siebel environment, amplifying data exposure beyond the initial target. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.