CVE-2026-83146

CVE-2026-83146 is a difficult-to-exploit vulnerability (CVSS 3.1: 7.7, high) in the Open UI component of Oracle Siebel CRM End User, affecting supported versions 17.0 through 26.7. A low-privileged attacker with network access over HTTP must induce an authorized user to interact (for example, via crafted web content or a social-engineering step) in order to compromise the Siebel CRM End User application. Successful attacks can grant unauthorized creation, deletion, or modification of critical data, as well as unauthorized read access to all data reachable through Siebel CRM End User, and because the vulnerability has a scope change, successful attacks may also significantly impact additional products beyond Siebel itself. Organizations running supported Siebel CRM releases from 17.0 to 26.7 with Open UI exposed to users over HTTP are affected. There is no known public proof of concept, the flaw is not on the CISA Known Exploited Vulnerabilities list, and no active exploitation has been reported.

What to do: Apply the Oracle Critical Patch Update that delivers the fix for this CVE and move to a Siebel CRM release outside the affected 17.0-26.7 range as soon as the patched build is available from Oracle. In the interim, restrict network exposure of Open UI endpoints (VPN/allowlisting), enforce least-privilege roles for low-privileged accounts, and brief users on avoiding interaction with unsolicited links or content that targets Siebel sessions. Review audit logs for anomalous data modification or access by low-privileged End User accounts.