CVE-2026-83182

A difficult-to-exploit SQL injection flaw in the Configuration Tools component of Oracle Siebel CRM (Development installations) lets a low-privileged attacker with network access send malicious SQL and compromise the Siebel CRM Development environment. Successful attacks result in full impact to confidentiality, integrity, and availability — effectively a complete takeover of the affected development environment. All supported versions from 17.0 through 26.7 are affected. Exploitation requires an authenticated low-privilege account and is rated as having high attack complexity, and there is no public proof-of-concept or known in-the-wild exploitation to date. Oracle addressed the flaw via its Critical Patch Update process (CNA: [email protected]), and it is not on the CISA Known Exploited Vulnerabilities catalog.

What to do: Apply the Oracle Critical Patch Update that remediates this issue to all supported Siebel CRM installations (versions 17.0 through 26.7). Restrict network access to Siebel Development and Configuration Tools environments to trusted administrators and VPN ranges, and enforce least-privilege database credentials for application users. Audit low-privileged accounts for unusual SQL activity indicative of injection attempts.