CVE-2026-83181

Oracle Siebel CRM contains an easily exploitable vulnerability in the Workspaces component of the Siebel CRM Development product, affecting supported versions 17.0 through 26.7. An unauthenticated remote attacker with network access via HTTP can trigger the flaw with low attack complexity and no user interaction. Successful exploitation allows unauthorized read access to critical data — up to complete access to all data accessible to Siebel CRM Development — and the ability to cause a partial denial of service, with no impact on data integrity (CVSS 3.1 base score 8.2). Organizations running affected Siebel CRM versions, especially those with HTTP-reachable Workspaces endpoints, are at risk. The flaw is not in CISA's KEV catalog and no public proof-of-concept exists, so no active exploitation has been confirmed.

What to do: Apply the Oracle Critical Patch Update that remediates this CVE to all Siebel CRM installations running versions 17.0–26.7, prioritizing systems whose Workspaces endpoints are reachable over HTTP. Restrict network access to Siebel application servers (segmentation, VPN, or allow-listing) so unauthenticated HTTP requests cannot reach Workspaces. Review HTTP access logs for anomalous unauthenticated requests to Workspaces paths and investigate any unexplained data access or partial service outages.