CVE-2026-83075

CVE-2026-83075 is an easily exploitable flaw in the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications, affecting supported versions 22.3 through 26.7. An unauthenticated attacker with network access over HTTP can exploit the flaw without any user interaction or credentials, and successful attacks result in unauthorized access to critical data or complete read access to all Siebel CRM Cloud Applications data. The impact is confidentiality-only (CVSS 3.1 base score 7.5, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), meaning data theft is possible but no modification or disruption of service. Organizations running Siebel CRM Cloud Applications releases 22.3-26.7 are affected. No public proof-of-concept exists, the flaw is not on the CISA Known Exploited Vulnerabilities list, and no exploitation in the wild has been reported to date.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83075 and move Siebel CRM Cloud Applications to the fixed release at or beyond 26.7. Restrict network access to Siebel Cloud Manager HTTP endpoints to trusted sources or management networks until patched. Review access and data-export logs for unauthenticated HTTP activity against Cloud Manager to rule out pre-patch data exposure.