CVE-2026-83183

Published Sep 15, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel CRM Deployment. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Analysis

Technical impact

A flaw in Oracle Siebel CRM Deployment’s Server Infrastructure component allows an unauthenticated attacker with network access over HTTP to exploit the service. The vulnerability causes resource exhaustion, leading the deployment to hang or repeatedly crash, which results in a complete denial of service. The weakness is identified as CWE-400, indicating an unbounded resource consumption flaw.

Affected Systems

Oracle Corporation’s Siebel CRM Deployment is affected across all builds from version 17.0 through 26.7. Versions prior to 17.0 or beyond 26.7 are not listed as vulnerable. The vulnerability impacts only the Server Infrastructure component accessed via HTTP.

Risk and Exploitability

The CVSS 3.1 Base Score of 7.5 reflects a high severity due to availability impacts. The EPSS score of less than 1% suggests that exploitation in the wild remains rare. The vulnerability is not listed in the CISA KEV catalog. An attacker can trigger the denial of service by sending repeated HTTP requests that exhaust server resources without requiring authentication. Because the flaw affects the entire deployment, it poses a significant operational risk for organizations relying on Siebel CRM.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Oracle Corporation

Siebel CRM Deployment

affected

Version	Status	Constraints
`17.0`	affected	≤ 26.7

Configuration 1 [-]

cpe:2.3:a:oracle:siebel_crm:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Oracle

Siebel Crm Deployment

Version	Status	Scheme	Platform
`[17.0,26.7]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the patch or upgrade to a version newer than 26.7 as advertised in Oracle’s security advisory https://www.oracle.com/security-alerts/cspusep2026.html.
Restrict HTTP access to the Siebel CRM Deployment to trusted internal networks or specific IP ranges until the patch is deployed.
Implement request limiting or rate‑limiting controls on the HTTP entry points to the Server Infrastructure component to mitigate potential resource exhaustion.
Monitor system metrics and application logs for abnormal CPU or memory spikes that could indicate an ongoing exploitation attempt.

Generated by OpenCVE AI on September 18, 2026 at 19:50 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.470% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://www.oracle.com/security-alerts/cspusep2026.html

History

Sep 21, 2026 5:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Oracle siebel Crm
CPEs		cpe:2.3:a:oracle:siebel_crm::::::::
Vendors & Products		Oracle siebel Crm

Sep 18, 2026 9:30 PM Title updated View changes

Type	Values Removed	Values Added
Title	Siebel CRM Deployment Resource Exhaustion Causing Service Denial

Sep 17, 2026 3:00 AM Title updated View changes

Type	Values Removed	Values Added
Title		Siebel CRM Deployment Resource Exhaustion Causing Service Denial

Sep 16, 2026 12:30 AM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-400
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 15, 2026 8:15 PM Description updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel CRM Deployment. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
First Time appeared		Oracle Oracle siebel Crm Deployment
CPEs		cpe:2.3:a:oracle:siebel_crm_deployment::::::::
Vendors & Products		Oracle Oracle siebel Crm Deployment
References		https://www.oracle.com/security-alerts/cspusep2026.html
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`