This vulnerability exists in Oracle Siebel CRM Cloud Applications versions 22.3 to 26.7, specifically in the Siebel Cloud Manager component. It is exploitable by an attacker who already has high privilege logon access to the infrastructure where the application runs. Exploitation can result in unauthorized creation, deletion, or modification of critical data within Siebel CRM Cloud Applications, potentially extending to other products due to scope change. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) indicates local attack vector, low attack complexity, high privileges required, no user interaction, scope changed, and high confidentiality and integrity impacts. Oracle has published this vulnerability as part of its September 2026 Critical Security Patch Update advisory but does not explicitly state patch availability for this specific CVE in the provided content.

The vulnerability allows a high privileged attacker with access to the infrastructure to fully compromise the confidentiality and integrity of Siebel CRM Cloud Applications data. This includes unauthorized creation, deletion, or modification of critical data. The scope change indicates that other Oracle products integrated or related to Siebel CRM Cloud Applications may also be impacted. There is no impact on availability. The CVSS score of 7.9 reflects a high severity level.

Oracle strongly recommends applying security patches promptly as part of their Critical Security Patch Update process. Although the vendor advisory does not explicitly confirm patch availability for CVE-2026-83079, it is included in the September 2026 Critical Security Patch Update, which contains numerous security fixes. Customers should verify patch availability and apply updates without delay to mitigate this vulnerability. Maintaining actively supported versions and timely patching is critical. No vendor advisory statement indicates that no action is required or that the issue is already mitigated without patching.