Oracle Siebel CRM CVE-2026-83144

Exploitation requires the attacker to hold a valid low-privileged account on the Siebel Apps - Customer Order Management (Order Management component) application reachable over HTTP, and requires human interaction from a different, typically higher-privileged user who must view or act on the attacker-supplied content (UI:R). It affects Siebel CRM versions 17.0 through 26.7. The limiting factors that reduce realistic risk are: mandatory prior authentication (no pre-auth path despite the 'Authentication Bypass' tag), the need to socially engineer or wait for a victim to interact, and absence of any availability impact (A:N). The scope change (S:C) means a successful attack in the victim's context can reach additional connected Oracle products beyond Order Management itself.

This is a genuine but conditional priority. The Oracle-supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, base 8.7) describes a low-privileged, network-reachable flaw in Siebel Order Management that requires human interaction from a victim other than the attacker and produces a scope change with high confidentiality and integrity impact but no availability impact. That profile - authenticated attacker, mandatory victim interaction, C:H/I:H/A:N, S:C - is the classic signature of a stored/reflected cross-site scripting or client-side injection issue in a web CRM, not a pre-auth server RCE, despite the misleading 'Authentication Bypass' tag. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active or automated exploitation; exploitation status is therefore best treated as no public exploit identified at time of analysis. The 8.7 is well-calibrated for the described impact but the real-world urgency is tempered by two honest limiters baked into the vector itself: PR:L (attacker needs a valid low-privilege Siebel session) and UI:R (a legitimate user must be induced to act). Note the conflict between the vector (PR:L, authenticated) and the 'Authentication Bypass' tag - the tag is wrong; treat this as an authenticated, victim-assisted attack.

A low-privileged but authenticated Siebel user injects a malicious payload into an Order Management field or request; when a higher-value user (e.g., an order administrator) later views that data through the Siebel web UI, the payload executes in their session, letting the attacker read or alter critical order/customer data and pivot into additional connected products (scope change). No public POC or exploit code is identified in the available data, and success depends on the victim opening the crafted content.