CVE-2026-83226 is a vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM, specifically in the Server Infrastructure component. It affects supported versions 17.0 through 26.7. The vulnerability requires network access via HTTP and low privilege but is difficult to exploit. Successful exploitation can lead to full compromise of the Siebel CRM Deployment. The CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting high impact on confidentiality, integrity, and availability. Oracle's September 2026 Critical Security Patch Update includes a fix for this vulnerability as part of a broad set of patches.

If exploited, this vulnerability allows an attacker with low privileges and network access to take over the Siebel CRM Deployment, impacting confidentiality, integrity, and availability of the system. The difficulty of exploitation is high, but successful attacks can result in full system compromise.

Oracle has released a security patch for this vulnerability in the September 2026 Critical Security Patch Update. Customers are strongly advised to apply this patch promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No additional vendor advisory states that no action is required or that the issue is already mitigated without patching.