CVE-2026-83201

Oracle Siebel CRM's Deployment product (Server Infrastructure component) contains an easily exploitable flaw affecting versions 17.0 through 26.7 that allows an unauthenticated attacker with network access via HTTP to compromise the Siebel CRM Deployment component. Exploitation requires no privileges, no user interaction, and low attack complexity, letting a remote attacker create, delete, or modify critical data as well as read all data accessible to the component. The vulnerability carries a CVSS 3.1 base score of 9.1, with high confidentiality and integrity impacts and no availability impact, consistent with an authentication bypass or missing-authorization flaw rather than code execution. Any organization running a supported Siebel CRM release in the 17.0–26.7 range with HTTP-reachable Siebel server infrastructure is affected. The flaw is not in the CISA Known Exploited Vulnerabilities catalog and no public proof-of-concept is known, suggesting no observed in-the-wild exploitation to date.

What to do: Apply the relevant Oracle Critical Patch Update fix for your Siebel CRM release as soon as possible, since all supported versions from 17.0 through 26.7 are affected. Until patched, restrict network access to Siebel CRM Deployment/Server Infrastructure HTTP endpoints (e.g., via firewall rules, VPN, or reverse-proxy allowlisting) so they are not reachable by unauthenticated external users. Review audit logs and database change history for unexplained data creation, modification, or deletion, and rotate credentials associated with the Siebel Deployment component if anomalies are found.