CVE-2026-83154

CVE-2026-83154 is a critical (CVSS 9.1) vulnerability in the Open UI component of Oracle Siebel CRM's End User product, affecting all supported versions from 17.0 through 26.7. It is easily exploitable by an unauthenticated attacker with network access who can reach the product's SOAP interface, requiring no privileges or user interaction. A successful attack lets the attacker create, delete, or modify critical data — or all data accessible to the Siebel CRM End User application — as well as read that data in full, with high impacts on both confidentiality and integrity (availability is not affected). Any organization running Siebel CRM within the affected version range with a network-reachable SOAP endpoint is exposed, particularly if the service is internet-facing. The flaw is not currently listed in CISA's KEV catalog, no public proof-of-concept is known, and no exploitation in the wild has been reported.

What to do: Apply the Oracle Critical Patch Update that fixes CVE-2026-83154 for your Siebel Innovation Release, or upgrade to a release later than 26.7 (e.g., 26.8+). Restrict and segment network access to Siebel SOAP/EAI web service endpoints so they are not reachable from untrusted networks such as the internet. Review application and web server logs for unauthenticated SOAP requests, unexpected record creation/deletion, or anomalous data modifications that could indicate prior probing or compromise.