CVE-2026-83225

CVE-2026-83225 is an easily exploitable flaw in the Server Infrastructure component of Oracle Siebel CRM's Deployment product, affecting supported versions 17.0 through 26.7. An unauthenticated remote attacker who can reach the Siebel server over TCP can trigger the vulnerability without any credentials or user interaction. Successful attacks cause the Siebel CRM Deployment to hang or repeatedly crash, resulting in a complete denial of service; there is no impact on confidentiality or integrity. Any organization running an affected Siebel CRM version with the server infrastructure reachable by untrusted networks is at risk. There is no known public proof of concept, the flaw is not on CISA's Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation has been reported to date.

What to do: Apply Oracle's Critical Patch Update for Siebel CRM as soon as it covers CVE-2026-83225, or request an interim patch from Oracle Support if you cannot wait for the quarterly cycle. Until patched, restrict TCP access to Siebel server infrastructure ports (including SARM/application server ports) to trusted administration and integration networks via firewalls and ACLs. Monitor Siebel server logs for repeated crashes or hangs consistent with denial-of-service attempts and ensure rapid restart procedures are in place.