CVE-2026-83154
CRITICAL 9.1 ALL-YEARSVulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise Siebel CRM End User. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM End User accessible data as well as unauthorized access to critical data or complete access to all Siebel CRM End User accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Severe if exploited (CVSS 9.1), but no confirmed exploitation. Patch on a normal cadence.
Exploitation likelihood
0.4%chance of exploitation in 30 days · 35th percentile
Impact if exploited
9.1CVSS 3.1 · CRITICAL · CNA
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityNone
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept & exploit code
No public exploit or proof-of-concept code is catalogued for this CVE (no ExploitDB, Nuclei, or CISA-KEV entry). It may still exist — search GitHub or check the references below.
Weakness (CWE)
- CWE-306: Missing Authentication for Critical Function
- CWE-287: Improper Authentication
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Known Affected Software Configurations
| Vendor | Product | Version range |
|---|---|---|
| Oracle | Siebel Crm | ≥ 17.0 and ≤ 26.7 |
All CVSS metrics
- CRITICAL 9.1 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - CRITICAL 9.1 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N