CVE-2026-83201 is a critical vulnerability in Oracle Siebel CRM Deployment's Server Infrastructure component affecting versions 17.0 to 26.7. The flaw allows unauthenticated remote attackers to exploit the system over HTTP to gain unauthorized access and perform unauthorized data modifications or deletions. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality and integrity impacts. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes targeted security fixes for this and many other vulnerabilities. Oracle strongly recommends applying the provided patches promptly to mitigate the risk.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Siebel CRM Deployment, or unauthorized access to all data accessible by the system. This compromises confidentiality and integrity of the affected system's data. There is no reported impact on availability. The vulnerability is exploitable remotely without authentication, increasing the risk of attack.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among others. Customers should apply the official Oracle patches without delay to remediate this issue. Oracle strongly recommends remaining on actively-supported versions and promptly applying security patches. No alternative mitigations or temporary fixes are indicated in the advisory.