CVE-2026-83207

CVE-2026-83207 is a vulnerability in the Integration - Scripting component of the Siebel CRM Development product of Oracle Siebel CRM, affecting supported versions 17.0 through 26.7. It is easily exploitable by a low-privileged (authenticated) attacker with network access via HTTP, requiring no user interaction. A successful attack can cause a complete denial of service (hang or frequently repeatable crash) of the Siebel CRM Development environment, and can also give the attacker unauthorized update, insert, and delete access to some accessible data plus unauthorized read access to a subset of that data. The flaw is scored CVSS 3.1 7.6 (high) with availability impact being the most severe consequence. It is not listed in the CISA KEV catalog, no public proof-of-concept is known, and no in-the-wild exploitation has been reported.

What to do: Apply Oracle's Critical Patch Update that remediates this CVE; all supported versions 17.0 through 26.7 are affected, so installations must move to a patched release. Restrict network/HTTP access to Siebel CRM Development environments to trusted users and segments, enforce least-privilege roles for low-privileged accounts, and review logs for anomalous scripting/integration activity or repeated crashes indicating exploitation attempts.