CVE-2026-83222

CVE-2026-83222 is an easily exploitable vulnerability in the Server Infrastructure component of Oracle Siebel CRM's Deployment product, affecting all supported versions from 17.0 through 26.7. An unauthenticated remote attacker with network access via multiple protocols can trigger the flaw, causing the Siebel CRM Deployment to hang or crash repeatedly — a complete denial of service. The vulnerability has no impact on confidentiality or integrity, but availability impact is high, earning a CVSS 3.1 base score of 7.5. Organizations running on-premises Siebel CRM deployments with network-reachable server infrastructure are the primary affected population. As of now, the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog and no public proof-of-concept is known.

What to do: Apply the Oracle Critical Patch Update that addresses CVE-2026-83222 to all Siebel CRM Server Infrastructure installations running versions 17.0-26.7. Until patched, restrict network access to Siebel server ports (management, gateway, and application protocols) to trusted sources via firewall rules or VPN, since the flaw requires no authentication. Monitor Siebel Server logs for unexplained hangs or repeated crashes, which are the observable symptoms of attacks against this vulnerability.