CVE-2026-83326

CVE-2026-83326 is a high-severity (CVSS 7.5) information disclosure flaw in the Open Integration component of Oracle Siebel CRM Integration, affecting releases 25.12 through 26.7. An unauthenticated remote attacker can trigger the flaw by sending crafted HTTP requests to a network-reachable Siebel CRM Integration endpoint, with no user interaction or privileges required. A successful attack yields unauthorized access to critical data, up to complete access to all data reachable through Siebel CRM Integration, though integrity and availability are not impacted. Organizations running Siebel CRM versions 25.12–26.7 with integration endpoints exposed to untrusted networks are the primary concern. No public proof-of-concept exists and the vulnerability is not on CISA's KEV list, so exploitation is not currently known.

What to do: Apply Oracle's Critical Patch Update that addresses CVE-2026-83326 to all Siebel CRM Integration instances running versions 25.12–26.7. Until patched, restrict network access to Open Integration endpoints (firewall rules, reverse proxy allow-lists, VPN) and enable logging/alerting on unauthenticated requests to those endpoints. Review access logs for anomalous data retrieval from integration services to rule out prior exploitation.