CVE-2026-83074

CVE-2026-83074 is a high-severity (CVSS 3.1: 8.6) vulnerability in the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications, affecting releases 22.3 through 26.7. It is easily exploitable by an unauthenticated attacker who has network access to the target via SSH, requiring no privileges or user interaction. A successful attack results in unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data, and because the vulnerability has a scope change, successful attacks may also significantly impact additional products beyond Siebel itself. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) indicates a pure confidentiality impact with no direct effect on integrity or availability. The flaw is not in CISA's Known Exploited Vulnerabilities catalog and no public proof-of-concept is known, so exploitation status is currently none known.

What to do: Apply the Oracle Critical Patch Update that remediates this issue, moving off any affected release in the 22.3-26.7 range. Restrict network and SSH access to the Siebel Cloud Manager host (VPN/bastion, strict allowlists, disable direct internet SSH exposure) and enforce strong key-based authentication. Review SSH authentication and session logs for the Cloud Manager system for signs of unauthorized access or anomalous data retrieval.