CVE-2026-83209
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Workflow) affecting versions 17.0-26.7. Easily exploitable by a low privileged attacker with network access via HTTP. Successful attacks can result in takeover of the component.
Risk Assessment
A low privileged attacker can take over the Siebel CRM Development component, impacting confidentiality, integrity, and availability. The CVSS score of 8.8 indicates very high risk.
Recommendation
Apply Oracle patches for versions 17.0-26.7 and restrict HTTP access to the Workflow component. Monitor logs for unauthorized workflow changes.
Other vulnerabilities in Oracle Siebel CRM
See all- CVE-2026-91393Low
Vulnerability in Oracle Siebel CRM End User (Open UI component) affecting versions 17.0-26.9. A difficult-to-exploit flaw allows an unauthenticated network attacker via HTTP to modify, insert, or delete some data, but requires user interaction.
- CVE-2026-91392Low
Vulnerability in Oracle Siebel CRM End User (Open UI component) affecting versions 17.0-26.9. A difficult-to-exploit flaw allows an unauthenticated network attacker via HTTP to modify, insert, or delete some data without user interaction.
- CVE-2026-91391Low
Vulnerability in Oracle Siebel CRM End User (Open UI component) affecting versions 17.0-26.9. A difficult-to-exploit flaw allows an unauthenticated network attacker via HTTP to read a subset of data without authorization.
- CVE-2026-91390Medium
Vulnerability in the Open UI component of Siebel CRM End User (versions 17.0-26.9). A low-privileged attacker with HTTP network access can, with user interaction, perform unauthorized modification and read access to some data, potentially impacting additional products.
- CVE-2026-91389Medium
Vulnerability in the Open UI component of Siebel CRM End User (versions 17.0-26.9). A low-privileged attacker with HTTP network access can, with user interaction, perform unauthorized modification and read access to some data, potentially impacting additional products.
- CVE-2026-91388Medium
Vulnerability in the Open UI component of Siebel CRM End User (versions 17.0-26.9). A difficult-to-exploit flaw allows an unauthenticated attacker with HTTP network access, with user interaction, to perform unauthorized modification and read access to some data, potentially impacting additional products.
- CVE-2026-91387Medium
Vulnerability in the Open UI component of Siebel CRM End User (versions 17.0-26.9). A low-privileged attacker with HTTP network access can perform unauthorized modification and read access to some data.
- CVE-2026-91372Low
Vulnerability in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component) affecting versions 22.3-26.9. An easily exploitable flaw allows a low-privileged attacker with local access to read a subset of data without authorization.
- CVE-2026-101476Medium
Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). An unauthenticated attacker with network access via HTTP can easily exploit this vulnerability, but successful attacks require human interaction. This can result in unauthorized update, insert or delete access to some Siebel Apps - Marketing accessible data.
- CVE-2026-101468High
Vulnerability in Oracle Siebel CRM Deployment (component: Cloud Gateway). An unauthenticated attacker with network access via HTTP can gain unauthorized access to critical data or all data accessible in Siebel CRM Deployment.
Original NVD description (English source)
Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Workflow). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Development. Successful attacks of this vulnerability can result in takeover of Siebel CRM Development. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS

