Description
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM End User accessible data as well as unauthorized update, insert or delete access to some of Siebel CRM End User accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
Published: 2026-09-15
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Access and Modification of Data
Action: Assess Impact
AI Analysis

Impact

The vulnerability in the Open UI component of Oracle Siebel CRM End User is an improper access control flaw (CWE-284). An attacker with low privileges and network access via HTTP can read or modify data that should be restricted, leading to confidentiality and integrity breaches. The flaw allows the attacker to retrieve or alter critical data without proper authentication or authorization, effectively bypassing application security controls.

Affected Systems

Oracle Siebel CRM End User, specifically the Open UI component, is affected. Versions 17.0 through 26.7 contain the flaw and should be considered vulnerable if deployed.

Risk and Exploitability

The CVSS v3.1 score of 7.1 indicates medium‑to‑high severity, impacting confidentiality and integrity. The EPSS score is reported as less than 1 %, suggesting that widespread exploitation is currently low, but the vulnerability is still considered easily exploitable from the network. It is not listed in CISA’s KEV catalog. Exploitation can occur via a remote HTTP request to the Open UI endpoints from an external or internal low‑privileged user without user interaction beyond sending the request.

Generated by OpenCVE AI on September 21, 2026 at 19:40 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Configure firewall or reverse‑proxy rules to allow HTTP traffic to the Open UI component only from trusted hosts and enforce authentication before it reaches the application.
  • Validate that the application enforces proper access controls on Open UI endpoints and conduct penetration testing to ensure remediation.
  • Monitor Oracle security advisories for patches or updates and plan deployment accordingly.

Generated by OpenCVE AI on September 21, 2026 at 19:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 22 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 21 Sep 2026 20:00:00 +0000

Type Values Removed Values Added
Title Improper Access Control in Oracle Siebel CRM End User Open UI

Mon, 21 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Title OpenUI Access Control Flaw in Siebel CRM End User Allows Unauthorized Data Access and Modification
Weaknesses CWE-284

Thu, 17 Sep 2026 01:15:00 +0000

Type Values Removed Values Added
Title OpenUI Access Control Flaw in Siebel CRM End User Allows Unauthorized Data Access and Modification
Weaknesses CWE-284

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM End User accessible data as well as unauthorized update, insert or delete access to some of Siebel CRM End User accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
First Time appeared Oracle
Oracle siebel Crm End User
CPEs cpe:2.3:a:oracle:siebel_crm_end_user:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle siebel Crm End User
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'}

Subscriptions

Oracle Siebel Crm End User
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-21T16:46:04.889Z

Reserved: 2026-08-31T15:40:57.347Z

Link: CVE-2026-83217

cve-icon Vulnrichment

Updated: 2026-09-21T16:45:55.319Z

cve-icon NVD

Status : Deferred

Published: 2026-09-15T20:18:33.400

Modified: 2026-09-21T17:19:06.817

Link: CVE-2026-83217

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-21T19:45:17Z

Weaknesses