Siebel CRM CVE-2026-83087

Exploitation requires a valid but low-privileged authenticated account in Siebel CRM Cloud Applications (PR:L in the CVSS vector) plus network access to the Siebel Cloud Manager HTTP interface (AV:N); no user interaction is needed (UI:N), but attack complexity is high (AC:H), meaning the attacker must satisfy specific preconditions - precise request construction, particular application state, or a specific Cloud Manager configuration - rather than fire a single generic request. The affected deployment mode is the Oracle-hosted Siebel CRM Cloud Applications cloud service on versions 22.3 through 26.7 with the Cloud Manager component exposed; on-premises or heavily customized Siebel deployments outside that version range are not covered by this record. What limits real-world exploitation: valid credentials are a hard prerequisite (no anonymous path is described), the high attack complexity defeats simple automated scanning, and the described difficult-to-exploit nature means a successful attempt may need iteration and knowledge of the target's tenant layout.

Signals point to a serious but not trivially exploitable issue. CVSS 3.1 scores 8.2 with high confidentiality and integrity impact and a scope change, but the AC:H and PR:L metrics materially reduce real-world likelihood: an attacker needs a valid low-privileged account and must satisfy non-trivial, likely state- or configuration-dependent conditions to trigger the flaw. There is no CVSS attack on availability (A:N), so denial of service is not an expected outcome. EPSS, KEV status and POC availability were not provided in the input data, so no active-exploitation claim can be made - the correct status is 'no public exploit identified at time of analysis'. In an SSVC framing, exploitation is 'none' as far as the supplied data shows, technical impact is 'partial/systemic' given the scope change, and automatable is at best 'no' because of AC:H and PR:L; this argues for prioritization behind actively exploited issues but ahead of routine patch cycles given the scope change and the sensitivity of multi-tenant CRM data. Note explicitly: the absence of EPSS and KEV data in this feed is a data gap, not evidence of low risk.

An attacker who already holds a low-privileged account in a targeted Siebel CRM Cloud Applications tenant uses it to send crafted HTTP requests to the Siebel Cloud Manager management interface. Because the vulnerability allows the attacker to exceed their assigned permissions, they retrieve and then modify critical CRM records - and, owing to the scope change, potentially reach data belonging to additional products tied to the same cloud management plane. The high attack complexity suggests the successful request pattern requires specific state, ordering or configuration to be right, which is why the flaw is not considered scriptable or mass-exploitable, and no public exploit code was identified in the source data.