CVE-2026-83143

CVE-2026-83143 is a high-severity (CVSS 3.1: 8.1) vulnerability in the eDetailing component of Siebel Apps – Life Sciences, part of Oracle Siebel CRM, affecting versions 17.0 through 26.7. An unauthenticated attacker with network access over HTTP can exploit the flaw, but a successful attack requires a human victim to interact with attacker-crafted content (per the UI:R vector), which typically points to a CSRF or similar interaction-dependent attack. If successful, the attacker gains unauthorized ability to create, delete, or modify critical data as well as read access to some or all Siebel Apps – Life Sciences data, with high confidentiality and integrity impact and no availability impact. Organizations running affected Siebel CRM Life Sciences deployments exposed over HTTP are at risk. No public proof-of-concept exists and no exploitation in the wild has been reported; the flaw is not on the CISA Known Exploited Vulnerabilities list.

What to do: Apply the Oracle Critical Patch Update (CPU) that delivers the fix for CVE-2026-83143 and upgrade affected Siebel Apps – Life Sciences deployments from the 17.0–26.7 range to a patched release. In the interim, remove direct HTTP exposure of the eDetailing application (VPN, IP allowlisting, reverse proxy with SSO/MFA) and reinforce anti-CSRF/session hygiene plus user awareness of social-engineering lures that trigger the required victim interaction. Review audit logs for unexpected data creation, modification, or deletion in Life Sciences records.