CVE-2026-83085

A high-severity vulnerability (CVSS 3.1: 8.2) exists in the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications, affecting versions 22.3 through 26.7. It is described as easily exploitable by a low-privileged attacker who already has access to the physical communication segment (local/adjacent network) attached to the hardware where the Siebel CRM Cloud Applications run — meaning it is not remotely exploitable from the open internet but is reachable by anyone on the same network segment, such as a compromised internal host or low-privileged insider. A successful attack can result in unauthorized access to critical data or complete read access to all data accessible to the application, unauthorized update, insert or delete access to some of that data, and a partial denial of service; the scope is changed (S:C), so successful attacks may also significantly impact additional products beyond Siebel CRM Cloud Applications. Organizations running affected Siebel CRM Cloud Applications deployments should treat this as a serious insider/adjacent-network threat. There is no known public proof of concept and no confirmed in-the-wild exploitation, and the CVE is not on CISA's Known Exploited Vulnerabilities catalog.

What to do: Apply Oracle's Critical Patch Update that remediates this flaw if you run Siebel CRM Cloud Applications versions 22.3-26.7, prioritizing any environment whose Siebel Cloud Manager hosts sit on broadly shared network segments. Because exploitation requires a low-privileged foothold on the adjacent network segment, tighten network segmentation and access controls around the Siebel Cloud Manager infrastructure and audit low-privileged accounts and lateral-movement activity on those segments. Review logs for unexpected bulk data reads, unauthorized inserts/updates/deletes, or partial service disruption traceable to adjacent-network sources.