CVE-2026-83202 is a critical vulnerability in Oracle Siebel CRM Deployment's Server Infrastructure component affecting versions 17.0 through 26.7. The flaw allows unauthenticated remote attackers to gain unauthorized access and perform unauthorized creation, deletion, or modification of critical data via HTTP network access. The vulnerability has a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating it is remotely exploitable without privileges or user interaction and results in high confidentiality and integrity impacts. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes targeted patches for this and other vulnerabilities. Customers are urged to apply these patches without delay to prevent exploitation.

Successful exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within the Siebel CRM Deployment environment. Attackers can gain complete unauthorized access to all data accessible by the Siebel CRM Deployment, compromising confidentiality and integrity. There is no reported impact on availability. The vulnerability is remotely exploitable over HTTP without authentication or user interaction, making it highly critical.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should promptly apply the relevant patches for Oracle Siebel CRM Deployment versions 17.0 through 26.7 to remediate this vulnerability. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation. No additional mitigations or workarounds are specified in the advisory.