CVE-2026-83145
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
Vulnerability in Oracle Siebel CRM Siebel Apps - Customer Order Management product (Order Management component). Affects versions 17.0-26.7. Easily exploitable, requires low privileges, network access via HTTP, and user interaction. Attacks may impact additional products (scope change) and lead to unauthorized creation, deletion, modification, or access to data.
Risk Assessment
Risk of compromise of confidentiality and integrity of critical data and all data accessible in Siebel Apps - Customer Order Management. Attacks may have broader impact on other products.
Recommendation
Apply patches provided by Oracle for versions 17.0-26.7. Restrict network access to the Order Management component and require authentication.
Other vulnerabilities in Oracle Siebel CRM
See all- CVE-2026-91393Low
Vulnerability in Oracle Siebel CRM End User (Open UI component) affecting versions 17.0-26.9. A difficult-to-exploit flaw allows an unauthenticated network attacker via HTTP to modify, insert, or delete some data, but requires user interaction.
- CVE-2026-91392Low
Vulnerability in Oracle Siebel CRM End User (Open UI component) affecting versions 17.0-26.9. A difficult-to-exploit flaw allows an unauthenticated network attacker via HTTP to modify, insert, or delete some data without user interaction.
- CVE-2026-91391Low
Vulnerability in Oracle Siebel CRM End User (Open UI component) affecting versions 17.0-26.9. A difficult-to-exploit flaw allows an unauthenticated network attacker via HTTP to read a subset of data without authorization.
- CVE-2026-91390Medium
Vulnerability in the Open UI component of Siebel CRM End User (versions 17.0-26.9). A low-privileged attacker with HTTP network access can, with user interaction, perform unauthorized modification and read access to some data, potentially impacting additional products.
- CVE-2026-91389Medium
Vulnerability in the Open UI component of Siebel CRM End User (versions 17.0-26.9). A low-privileged attacker with HTTP network access can, with user interaction, perform unauthorized modification and read access to some data, potentially impacting additional products.
- CVE-2026-91388Medium
Vulnerability in the Open UI component of Siebel CRM End User (versions 17.0-26.9). A difficult-to-exploit flaw allows an unauthenticated attacker with HTTP network access, with user interaction, to perform unauthorized modification and read access to some data, potentially impacting additional products.
- CVE-2026-91387Medium
Vulnerability in the Open UI component of Siebel CRM End User (versions 17.0-26.9). A low-privileged attacker with HTTP network access can perform unauthorized modification and read access to some data.
- CVE-2026-91372Low
Vulnerability in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component) affecting versions 22.3-26.9. An easily exploitable flaw allows a low-privileged attacker with local access to read a subset of data without authorization.
- CVE-2026-101476Medium
Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). An unauthenticated attacker with network access via HTTP can easily exploit this vulnerability, but successful attacks require human interaction. This can result in unauthorized update, insert or delete access to some Siebel Apps - Marketing accessible data.
- CVE-2026-101468High
Vulnerability in Oracle Siebel CRM Deployment (component: Cloud Gateway). An unauthenticated attacker with network access via HTTP can gain unauthorized access to critical data or all data accessible in Siebel CRM Deployment.
Original NVD description (English source)
Vulnerability in the Siebel Apps - Customer Order Management product of Oracle Siebel CRM (component: Order Management). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Apps - Customer Order Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel Apps - Customer Order Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel Apps - Customer Order Management accessible data as well as unauthorized access to critical data or complete access to all Siebel Apps - Customer Order Management accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS

