Oracle Siebel CRM CVE-2026-83213

Exploitation requires network reachability to the Siebel CRM End User Reports HTTP endpoint, and per the CVSS vector (PR:N/UI:N) no authentication and no user interaction are needed, so the conditions are limited to exposure of the Reports component rather than any credential or configuration prerequisite stated in the description. What limits risk in practice: the Siebel Reports interface is normally deployed on an internal network or behind a VPN rather than exposed to the internet, so an attacker generally must first obtain a foothold on the corporate network or a reachable trusted segment. The description does not state that any non-default setting, special role, or module must be enabled beyond having the Reports component present in the affected 17.0-26.7 release line. Impact is confined to confidentiality (read access to Siebel CRM End User data) - the flaw cannot be used to alter records or cause denial of service. No public exploit code or exploitation-in-the-wild reporting was supplied in the input, so an observed attack would currently require custom tooling.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N, 7.5) describes a low-skill, remotely reachable information-disclosure flaw: no authentication, no user interaction, no complexity, and high confidentiality impact. The metadata tags this as an 'Authentication Bypass', which is consistent with the PR:N rating and the confidentiality-only profile, so the two signals corroborate rather than conflict. However, real-world prioritization should be tempered: the input supplies no EPSS score, no CISA KEV entry, and no indication that public exploit code exists, so this is not confirmed as actively exploited. Attackers must be able to reach the Siebel Reports HTTP endpoint - typically an internally hosted enterprise CRM - so internet-facing exposure is not guaranteed. Comparing signals: the CVSS score argues for urgent patching, while the absence of exploitation telemetry and the internal-network nature of most Siebel deployments suggest a high-priority but not emergency posture. Note explicitly that the input contains no POC, EPSS, or KEV data; treat exploitation status as unconfirmed rather than negative. The description does not identify the specific endpoint, parameter, or configuration involved, so defenders cannot tightly scope exposure from this advisory alone.

An attacker with network access to a Siebel CRM deployment locates the public Reports HTTP interface - often reachable from the corporate LAN, VPN, or, in misconfigured environments, the internet. They craft a request to a report endpoint that omits expected session/credential context and, because the authorization check is missing, the application returns report data directly. The attacker iterates over report identifiers and parameters to harvest customer, account, or case data at scale, with no credentials and no interaction from any Siebel user.