CVE-2026-83229

A critical vulnerability (CVSS 9.1) exists in the Siebel Management Console component of Oracle Siebel CRM Deployment, affecting supported versions 17.0 through 26.7. It is easily exploitable by a high-privileged attacker with network access via HTTP, allowing them to fully compromise the Siebel CRM Deployment. The vulnerability has a scope change (S:C), meaning successful attacks can significantly impact additional products beyond the Siebel CRM Deployment component itself. Successful exploitation results in a complete takeover of the deployment with high impacts to confidentiality, integrity, and availability. There is no evidence of in-the-wild exploitation, and no public proof-of-concept is known.

What to do: Apply the Oracle Critical Patch Update that remediates this flaw to all Siebel CRM deployments running versions 17.0-26.7. Restrict network access to the Siebel Management Console so it is reachable only from trusted administrative networks, and enforce least-privilege on the high-privileged accounts that could be leveraged in an attack. Audit Management Console logs for anomalous activity by high-privilege accounts and monitor for unexpected configuration or deployment changes.