Description
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.7. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-09-15
Score: 7.4 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Modification and Deletion of Data
Action: Apply Patch
AI Analysis

Impact

The vulnerability exists in the Server Infrastructure component of Oracle Siebel CRM Deployment. An unauthenticated attacker who can reach the system via HTTP can create, delete, or modify data without providing any credentials. This unauthorized access can result in the loss of confidentiality and integrity of all data accessible through the deployment.

Affected Systems

The affected products are Oracle Siebel CRM Deployment for versions 17.0 through 26.7. Any installation of these versions that exposes the HTTP interface is susceptible to the described flaw.

Risk and Exploitability

The CVSS 3.1 base score of 7.4 indicates a moderate-to-high severity. The EPSS score of less than 1% suggests a low probability that the vulnerability will be exploited in the wild. The flaw is not listed in the CISA KEV catalog. The likely attack vector is a network-based HTTP request from an unauthenticated source, requiring no special privileges or credentials to gain the described capabilities.

Generated by OpenCVE AI on September 18, 2026 at 19:55 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest patch or update released by Oracle for Siebel CRM Deployment that addresses the Server Infrastructure flaw
  • Restrict HTTP access to the deployment to trusted networks or VPNs by configuring firewalls or access control lists
  • Review and harden server configuration to limit or disable the vulnerable functionality if the patch cannot be applied immediately

Generated by OpenCVE AI on September 18, 2026 at 19:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Enables Unauthorized Data Manipulation in Oracle Siebel CRM Deployment

Wed, 16 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Enables Unauthorized Data Manipulation in Oracle Siebel CRM Deployment
Weaknesses CWE-284

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.7. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle siebel Crm Deployment
CPEs cpe:2.3:a:oracle:siebel_crm_deployment:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle siebel Crm Deployment
References
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Siebel Crm Deployment
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-18T18:23:50.402Z

Reserved: 2026-08-31T15:40:57.347Z

Link: CVE-2026-83218

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-09-15T20:18:33.510

Modified: 2026-09-18T19:16:50.470

Link: CVE-2026-83218

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-18T20:15:14Z

Weaknesses