CVE-2026-83213

CVE-2026-83213 is a high-severity (CVSS 7.5) information disclosure vulnerability in the Reports component of Oracle Siebel CRM's End User application, affecting versions 17.0 through 26.7. The flaw is easily exploitable: an unauthenticated attacker with network access to the Siebel server over HTTP can trigger it without any user interaction, requiring only low-complexity attack conditions. A successful attack allows the attacker to read critical data or gain complete access to all data reachable through the Siebel CRM End User application, with no impact on integrity or availability. Organizations running the affected Siebel CRM versions, particularly those with internet-facing Siebel endpoints, are at risk of exposure of customer and business data. No public proof-of-concept exists, the issue is not on the CISA KEV list, and no exploitation in the wild has been reported to date.

What to do: Apply the Oracle Critical Patch Update (CPU) that remediates CVE-2026-83213 to all Siebel CRM installations running versions 17.0-26.7. Restrict network access to Siebel End User and Reports endpoints so they are not directly reachable from the internet (VPN/reverse proxy with enforced authentication), and review HTTP access logs for unauthenticated requests targeting Reports URLs to rule out prior data access.