CVE-2026-83079

CVE-2026-83079 is a high-severity (CVSS 7.9) flaw in the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications, affecting supported versions 22.3 through 26.7. It is easily exploitable by an attacker who already holds high privileges and has logged on to the infrastructure where the Siebel cloud deployment executes, i.e., a local attack path rather than a remote one. Because the vulnerability changes scope, a successful attack can impact products beyond Siebel itself and grants unauthorized creation, deletion, or modification of critical data, plus full read access to all data accessible through Siebel CRM Cloud Applications (high confidentiality and integrity impact, no availability impact). Affected organizations are enterprises running Oracle Siebel CRM in the cloud under the listed versions, particularly those with broad or poorly monitored privileged access on hosting infrastructure. There is no known public PoC, it is not on the CISA KEV list, and no exploitation in the wild has been reported.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83079 to all Siebel CRM Cloud Applications deployments in the 22.3-26.7 range. Enforce least-privilege and MFA for accounts with logon access to the infrastructure hosting Siebel Cloud Manager, and audit those accounts for anomalous activity. Review Siebel-accessible data for unauthorized creation, deletion, or modification, and rotate credentials for privileged infrastructure accounts if compromise is suspected.