CVE-2026-83199

CVE-2026-83199 is a high-severity (CVSS 8.8) vulnerability in the Server Infrastructure component of Oracle Siebel CRM's Deployment product, affecting supported versions 17.0 through 26.7. A low-privileged attacker with network access via HTTP can trigger the flaw, which Oracle rates as easily exploitable, and ultimately compromise the Siebel CRM Deployment, gaining full takeover with high impact on confidentiality, integrity, and availability. Any organization running an affected Siebel CRM version with the Deployment/Server Infrastructure component reachable over the network is exposed, particularly if low-privilege accounts (including self-registered or internal users) exist. Because the vulnerability requires only low privileges and no user interaction, compromised or insider low-tier accounts can be leveraged for full system compromise. No public proof of concept is known and the flaw is not on the CISA Known Exploited Vulnerabilities catalog, so exploitation in the wild is not currently indicated.

What to do: Apply the Oracle Critical Patch Update that remediates this flaw to all Siebel CRM installations running versions 17.0-26.7, prioritizing the Siebel CRM Deployment/Server Infrastructure component. Restrict HTTP/network access to Siebel servers to trusted VPN or internal networks, enforce least-privilege on Siebel user accounts, and review logs for suspicious activity by low-privilege accounts against deployment or server infrastructure endpoints.