CVE-2026-83078

A high-severity (CVSS 8.2) vulnerability exists in the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications, affecting supported versions 22.3 through 26.7. It is easily exploitable by an unauthenticated remote attacker with network access via HTTP, requiring no privileges or user interaction. Successful exploitation can yield unauthorized read access to critical data — potentially all data accessible to Siebel CRM Cloud Applications — as well as unauthorized update, insert, and delete access to some of that data; availability is not impacted. Any organization running Siebel CRM Cloud Applications with the Siebel Cloud Manager component in the affected version range and reachable over the network is exposed. No public proof of concept is known and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, so exploitation appears limited at this time.

What to do: Apply Oracle's Critical Patch Update that remediates this flaw and upgrade the Siebel Cloud Manager component to a patched release beyond the affected 22.3–26.7 range. Restrict network access to Siebel Cloud Manager HTTP endpoints (allow-list/VPN, avoid internet exposure) since the flaw is unauthenticated. Review audit and access logs on affected instances for unauthenticated access or unexpected data reads, updates, inserts, or deletes.