Description
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Migration). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in takeover of Siebel CRM Deployment. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-09-15
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

An attacker with low privileged access and network connectivity can exploit a SQL injection flaw in the Migration component of Oracle Siebel CRM Deployment. Successful exploitation results in a full takeover of the application, compromising confidentiality, integrity, and availability. The weakness corresponds to CWE‑89 and CWE‑20.

Affected Systems

Oracle’s Siebel CRM Deployment product is affected across versions 17.0 through 26.7. The vulnerability is present in the Migration component of these releases.

Risk and Exploitability

The CVSS v3.1 base score is 8.8, indicating high severity with full impact on confidentiality, integrity and availability. The EPSS score is below 1 %, suggesting low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, the attack requires only low privileges and remote network access, making it attractive to attackers who can target the migration interface or database backend. The exploitation path involves sending crafted SQL input to the Migration API, which is not adequately sanitized, leading to arbitrary code execution and takeover.

Generated by OpenCVE AI on September 16, 2026 at 21:43 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest official Oracle Siebel CRM Deployment security patch or upgrade to a version beyond 26.7.
  • Restrict network access to the migration component and database interfaces to authorized personnel only, using firewall rules and network segmentation.
  • Enforce strict input validation and use parameterized queries for all database interactions within the Migration component, following safeguards for CWE‑89 and CWE‑20.

Generated by OpenCVE AI on September 16, 2026 at 21:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 16 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
Title SQL Injection in Oracle Siebel CRM Deployment Enables Low-Privilege Takeover
Weaknesses CWE-20
CWE-89

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Migration). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in takeover of Siebel CRM Deployment. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle siebel Crm Deployment
CPEs cpe:2.3:a:oracle:siebel_crm_deployment:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle siebel Crm Deployment
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Siebel Crm Deployment
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-15T20:04:21.640Z

Reserved: 2026-08-31T15:40:57.346Z

Link: CVE-2026-83208

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-09-15T20:18:32.423

Modified: 2026-09-16T19:36:43.087

Link: CVE-2026-83208

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-16T21:45:06Z

Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')