CVE-2026-83155

An easily exploitable flaw in the Server Infrastructure component of the Siebel CRM Deployment product allows a low-privileged attacker with a foothold on the same physical network segment as the Siebel server to compromise the deployment. A successful attack gives unauthorized access to critical data — up to complete access to all data reachable by the Siebel CRM Deployment — and the ability to hang or repeatedly crash the service, producing a complete denial of service; integrity is not impacted. All supported Siebel CRM versions from 17.0 through 26.7 are affected. Because exploitation requires both an adjacent network position and low-privileged credentials, the practical risk sits on internal corporate networks rather than the public internet, and no public proof of concept or known in-the-wild exploitation has been reported. Oracle addressed the issue through its Critical Patch Update process.

What to do: Apply the Oracle Critical Patch Update that remediates this issue and move to a release beyond the affected 17.0–26.7 range. Restrict which hosts, VLANs, and low-privileged accounts can reach the network segments attached to Siebel CRM servers. Monitor Siebel server logs for anomalous data-access patterns and recurring crashes or hangs that could indicate exploitation attempts.