A critical scope-changing vulnerability in the Oracle Siebel CRM Management Console lets a network-based attacker with high privileges take over the entire Siebel CRM Deployment, with potential impact reaching adjacent products.
What Is It
CVE-2026-83229 is a vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM, specifically in the Siebel Management Console component. Oracle rates it CVSS 3.1 base score 9.1 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.
The flaw is described as easily exploitable over HTTP by an attacker holding high privileges on the network. No user interaction is required. Successful exploitation results in takeover of Siebel CRM Deployment.
Why It Matters
Two details carry the weight here. First, the impact triad is full high across confidentiality, integrity, and availability; this is a total compromise of the affected deployment, not a data leak or a crash.
Second, the scope is Changed (S:C). Oracle's wording is that while the vulnerability resides in Siebel CRM Deployment, attacks "may significantly impact additional products." That is a statement of possibility rather than a guarantee: the Changed scope flag means an exploit can cross the vulnerable component's security authority, but Oracle does not enumerate which additional products are affected or under what conditions. Treat cross-product impact as plausible and worth modelling, not as established.
The high privileges requirement (PR:H) lowers the exploitability subscore to 2.3 and is the only meaningful friction. In practice, that limits the flaw to post-compromise use: it is relevant to an attacker who has already obtained privileged access to a Siebel environment, a realistic position for an insider or an attacker mid-intrusion, where it offers a path to escalation and movement beyond the initial foothold.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Siebel CRM Deployment (Oracle Siebel CRM)
- Component: Siebel Management Console
- Affected versions: 17.0 through 26.7 (inclusive)
That version band spans a long run of supported releases, so the installed base of affected deployments is likely broad.
Patch Status
The CVE was published on 2026-09-15 with a vulnerability status of Received, meaning NVD analysis is not yet complete.
Fix availability could not be confirmed at the time of writing. Oracle ships security fixes for Siebel CRM through its Critical Patch Update program, and Oracle's published security alerts schedule sets that program on a fixed quarterly cycle, January, April, July, and October, so there is no September 2026 Critical Patch Update. By that schedule, the next CPU after this CVE's publication date is the October 2026 release, which is the most likely vehicle for a fix. Administrators should confirm patch availability and applicable patch levels for their release directly against Oracle's published CPU advisories and My Oracle Support, rather than relying on the link below.
This CVE does not appear in the CISA Known Exploited Vulnerabilities catalog based on the supplied data; there is no confirmation of active exploitation in the wild, and no KEV-mandated remediation deadline applies.
Sources
- Oracle security alert URL cited in the source data (unverified): https://www.oracle.com/security-alerts/cspusep2026.html; this URL was carried over from the upstream record and does not resolve to a corresponding Oracle advisory; it should not be treated as authoritative for this CVE.
- NVD, CVE-2026-83229, https://nvd.nist.gov/vuln/detail/CVE-2026-83229
- Oracle, Critical Patch Updates, Security Alerts and Bulletins, https://www.oracle.com/security-alerts/, Oracle's index of CPU releases and the published quarterly schedule (January, April, July, October), including the upcoming October 2026 CPU date.
- CISA, Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog; authoritative list to check for a KEV entry and any associated remediation deadline.