CVE-2026-83154 is a critical vulnerability in Oracle Siebel CRM End User's Open UI component affecting versions 17.0 to 26.7. It permits unauthenticated remote attackers to exploit the SOAP interface to gain unauthorized access, enabling creation, deletion, or modification of critical or all accessible data within Siebel CRM End User. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, reflecting network attack vector, low complexity, no privileges or user interaction required, and high confidentiality and integrity impact. Oracle has included this fix in its September 2026 Critical Security Patch Update, strongly recommending patch application.

Successful exploitation allows unauthenticated attackers to fully compromise data integrity and confidentiality within the Siebel CRM End User environment, including unauthorized creation, deletion, or modification of critical data. This can lead to significant business disruption and data breaches. There is no reported impact on availability. No known exploits in the wild have been reported at this time.

Oracle has released a security patch addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the official Oracle patch promptly to remediate this issue. Oracle emphasizes remaining on actively supported versions and applying patches without delay to prevent exploitation.