CVE-2026-83203

CVE-2026-83203 is a high-severity vulnerability in the Open UI component of Oracle Siebel CRM (End User product) affecting versions 17.0 through 26.7. It is easily exploitable by an unauthenticated attacker with network access via HTTP, requiring no privileges or user interaction. A successful attack can result in unauthorized access to critical data — or complete access to all Siebel CRM End User accessible data — as well as unauthorized update, insert, or delete access to some data and a partial denial of service. Any organization running a supported Siebel CRM release in the affected range with an internet-reachable or network-accessible Open UI endpoint is at risk. No public proof-of-concept exists and the flaw is not on the CISA KEV list, so exploitation is not currently observed.

What to do: Apply the Oracle Critical Patch Update that addresses this CVE and upgrade affected Siebel CRM 17.0-26.7 environments to the fixed release. Restrict network access to Siebel Open UI endpoints (VPN, IP allowlisting, or reverse proxy/WAF) so unauthenticated HTTP requests from the internet cannot reach them. Review access and application logs for unauthenticated data access or unexpected insert/update/delete activity, and validate that only authenticated, authorized users can reach the End User application.