CVE-2026-83086

A high-severity vulnerability (CVSS 3.1 base score 8.8) in the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications allows a low-privileged attacker with network access via HTTP to compromise the affected Siebel deployment. The flaw is rated easily exploitable: it requires only an authenticated low-privilege account, no user interaction, and no special conditions. Successful attacks can result in complete takeover of Siebel CRM Cloud Applications with high impact on confidentiality, integrity, and availability. All supported releases from 22.3 through 26.7 are affected. No public proof of concept exists, the issue is not on CISA's Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation is known.

What to do: Apply the Oracle Critical Patch Update addressing this CVE as soon as it is available and move Siebel Cloud Manager to a patched build or a release later than 26.7. Restrict HTTP/network access to the Cloud Manager interface to trusted administrative networks, and enforce least-privilege and strong authentication on all Siebel accounts since exploitation starts from a low-privileged login. Review audit logs for anomalous activity by low-privileged accounts against Cloud Manager endpoints.