Description
Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI). Supported versions that are affected are 17.0-26.7. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Integration. Successful attacks of this vulnerability can result in takeover of Siebel CRM Integration. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-09-15
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Apply Patch
AI Analysis

Impact

The vulnerability allows an attacker with low privileges and network access over HTTP to compromise the integration, potentially leading to takeover of the entire system. This would compromise confidentiality, integrity, and availability, giving the attacker full administrative access.

Affected Systems

Affected systems are Oracle Siebel CRM Integration products manufactured by Oracle Corporation, specifically the EAI component running versions 17.0 through 26.7. Networks that expose this component over HTTP are at risk. The vulnerability is documented for the Oracle Siebel CRM Integration CPE identifier.

Risk and Exploitability

The CVSS v3.1 score of 7.5 indicates high severity, while the EPSS value of less than 1% suggests a low probability of exploitation. The vulnerability is not currently listed in the CISA KEV catalog. However, the vulnerability requires network access via HTTP, a high complexity attack, and low privilege. An attacker who succeeds can take over the entire integration component, possibly leading to a full system compromise.

Generated by OpenCVE AI on September 18, 2026 at 19:13 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle security patch or upgrade to a version newer than 26.7 that contains the fix.
  • Limit HTTP access to the Siebel CRM Integration service to trusted hosts or implement a VPN to restrict external exposure.
  • Enforce strict role-based access controls and audit permissions for users who can modify integration configurations.
  • Monitor web server logs for anomalies or repeated attempts to access the integration endpoint, and implement alerting on suspicious activity.

Generated by OpenCVE AI on September 18, 2026 at 19:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 16 Sep 2026 22:30:00 +0000

Type Values Removed Values Added
Title Remote Code Execution Vulnerability in Oracle Siebel CRM Integration EAI
Weaknesses CWE-284
CWE-937

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI). Supported versions that are affected are 17.0-26.7. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Integration. Successful attacks of this vulnerability can result in takeover of Siebel CRM Integration. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle siebel Crm Integration
CPEs cpe:2.3:a:oracle:siebel_crm_integration:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle siebel Crm Integration
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Siebel Crm Integration
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-17T15:13:28.665Z

Reserved: 2026-08-31T15:40:57.347Z

Link: CVE-2026-83227

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-09-15T20:18:34.520

Modified: 2026-09-17T16:18:10.537

Link: CVE-2026-83227

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-18T19:15:11Z

Weaknesses