CVE-2026-83145

CVE-2026-83145 is a high-severity flaw (CVSS 3.1: 8.7) in the Order Management component of Oracle Siebel CRM's Customer Order Management application, affecting versions 17.0 through 26.7. It is easily exploitable over HTTP by a low-privileged (authenticated) attacker, but requires interaction from a victim user other than the attacker — a pattern consistent with cross-site request forgery or similar session-riding techniques. A successful attack allows unauthorized creation, deletion, or modification of critical order-management data, as well as unauthorized read access to all data accessible through the component, and because of a scope change it may also significantly impact additional products beyond Customer Order Management. Any organization running Siebel CRM Order Management in the affected version range is at risk, particularly deployments reachable by low-privilege internal or portal users. No public proof of concept is known and the flaw is not on the CISA KEV list, so exploitation in the wild is presumed unlikely at this time.

What to do: Apply the Oracle Critical Patch Update that addresses CVE-2026-83145 to all Siebel CRM installations running versions 17.0-26.7, prioritizing any environment where Customer Order Management is exposed to low-privilege or partner/portal users. In the interim, verify that anti-CSRF protections, session cookies with SameSite attributes, and network segmentation restricting HTTP access to Siebel application servers are in place. Review audit logs for anomalous order creation, deletion, or modification and unexpected data access by low-privileged accounts over the past several months.