CVE-2026-83197

CVE-2026-83197 is a critical (CVSS 9.1) flaw in the Financial Accounts component of Oracle Siebel Apps - Financial Services, affecting all supported versions from 17.0 through 26.7. It is easily exploitable by an unauthenticated attacker with network access via HTTP, requiring no privileges or user interaction. A successful attack allows the attacker to read critical data — up to complete access to all data accessible through Siebel Apps - Financial Services — and to cause a hang or frequently repeatable crash, resulting in complete denial of service. Integrity impact is rated as none, so the flaw is primarily a confidentiality and availability risk rather than code execution. No public proof-of-concept exists and the vulnerability is not on the CISA KEV list, so exploitation in the wild is not currently known.

What to do: Check Oracle's latest Critical Patch Update for the Siebel Financial Services fix and apply it to all instances running versions 17.0-26.7. In the interim, restrict HTTP access to Siebel Apps - Financial Services endpoints (network segmentation, VPN, or WAF rules) so they are not reachable by unauthenticated users or the internet. Review logs for anomalous unauthenticated requests against the Financial Accounts component and monitor for unexplained data access or repeated crashes/hangs.