CVE-2026-83180

Oracle Siebel CRM contains a high-severity (CVSS 8.8) vulnerability in the Siebel CRM Deployment component, specifically in Server Infrastructure, affecting versions 17.0 through 26.7. A low-privileged attacker with network access via HTTP can exploit this flaw — described by Oracle as easily exploitable — without any user interaction to fully compromise the Siebel CRM Deployment. A successful attack results in a complete takeover, with high impact on confidentiality, integrity, and availability of the affected deployment. In practice, this means any authenticated low-level user (such as a standard CRM end user with a reachable HTTP endpoint) could pivot to control of the deployment. No public proof of concept is known and the vulnerability is not on CISA's KEV list, so there is no evidence of active exploitation to date.

What to do: Apply the Oracle Critical Patch Update that remediates this issue, prioritizing any Siebel CRM Deployment instances running versions 17.0 through 26.7. Restrict HTTP access to Siebel server infrastructure so only trusted networks and authenticated users can reach it, and audit low-privileged accounts for suspicious privilege escalation or unauthorized administrative activity.