CVE-2026-83144

CVE-2026-83144 is a high-severity vulnerability in the Customer Order Management product of Oracle Siebel CRM (Order Management component), affecting all supported versions from 17.0 through 26.7. A low-privileged attacker with network access via HTTP can exploit the flaw easily, but successful attacks require a human victim to interact with attacker-controlled content — a pattern consistent with CSRF/client-side attack techniques — and the impact can extend beyond Order Management to additional products (scope change). A successful attack gives the attacker unauthorized ability to create, delete, or modify critical data, as well as unauthorized access to all data accessible through Siebel Apps - Customer Order Management, with high impacts on both confidentiality and integrity (no availability impact). The flaw is fixed in Oracle's Critical Patch Update corresponding to version 26.7 or later, and no public proof-of-concept or observed in-the-wild exploitation is known at this time.

What to do: Apply the Oracle Critical Patch Update that remediates this issue (upgrade to a Siebel CRM release/CPU beyond the affected 17.0-26.7 range). Because exploitation requires user interaction, enforce SameSite cookie attributes and short session timeouts on Siebel web clients, train order-management users against phishing/lure-driven interaction, and audit low-privileged accounts for anomalous data creation, modification, or access in Order Management records.