CVE-2026-83217

CVE-2026-83217 is a vulnerability in the Open UI component of Oracle Siebel CRM (End User product) affecting supported versions 17.0 through 26.7. A remote attacker who already holds a low-privileged account on the application can exploit it over HTTP with no user interaction, and Oracle rates it as easily exploitable. A successful attack compromises the Siebel CRM End User application, giving the attacker unauthorized read access to critical data — potentially all data reachable through End User — as well as unauthorized update, insert, or delete access to some of that data. The flaw scores 7.1 (High) on CVSS 3.1 with high confidentiality and low integrity impact and no availability impact. There is no known public proof of concept and no indication of in-the-wild exploitation; it was fixed via Oracle's Critical Patch Update process.

What to do: Apply the Oracle Critical Patch Update that addresses CVE-2026-83217 to all Siebel CRM 17.0–26.7 environments, prioritizing any Open UI endpoints reachable from the internet or partner networks. Restrict Open UI exposure with a VPN, IP allowlisting, or reverse-proxy authentication, and audit low-privileged user roles for over-broad access. Review application logs for anomalous bulk reads or unexpected update/insert/delete activity by low-privilege accounts.