CVE-2026-83087

CVE-2026-83087 is a difficult-to-exploit vulnerability in the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications, affecting releases 22.3 through 26.7. A remote attacker who already holds low-privilege credentials and has HTTP network access to the product can trigger the flaw and compromise Siebel CRM Cloud Applications. Because the vulnerability carries a scope change, successful attacks can also significantly impact additional products beyond Siebel itself. The impact is unauthorized creation, deletion, or modification of critical data (or all Siebel-accessible data), as well as unauthorized read access to critical data or complete access to all accessible data, reflected in a CVSS 3.1 base score of 8.2 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N). No public proof of concept exists, the flaw is not on the CISA KEV list, and no exploitation in the wild has been reported.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83087 to all Siebel CRM Cloud Applications instances running versions 22.3 through 26.7. Restrict HTTP access to Siebel Cloud Manager to trusted networks and strictly enforce least-privilege roles for low-privileged accounts, since exploitation requires valid low-privilege credentials. Review audit logs for anomalous data access, creation, or modification by low-privilege users, and check whether other products in the environment were touched given the scope-change impact.