CVE-2026-83202

CVE-2026-83202 is a critical (CVSS 9.1) flaw in the Server Infrastructure component of Oracle Siebel CRM Deployment, affecting supported versions 17.0 through 26.7. It is easily exploitable by an unauthenticated attacker with network access via HTTP, meaning no valid credentials or user interaction are required. A successful attack allows the attacker to create, delete, or modify critical data (or all data accessible to the Siebel CRM Deployment component), as well as read critical or all accessible data; availability is not impacted. Organizations running affected Siebel CRM versions with the deployment/server infrastructure reachable over a network — especially internet-exposed Siebel web endpoints — are at risk of silent data theft and tampering. The flaw is not in the CISA KEV catalog and no public proof-of-concept is known, so exploitation status is currently none known.

What to do: Apply the Oracle Critical Patch Update that addresses CVE-2026-83202 and move to a Siebel CRM release beyond the affected 17.0-26.7 range. Until patched, restrict HTTP access to Siebel Deployment/Server Infrastructure endpoints using firewalls, reverse proxies, or VPN-only access, and disable any unnecessary internet exposure. Review application and database audit logs for unauthenticated access patterns and unexplained creation, modification, or deletion of Siebel data.