CVE-2026-83203 is a high-severity vulnerability in the Open UI component of Oracle Siebel CRM End User product versions 17.0 through 26.7. It permits unauthenticated remote attackers to compromise the application via HTTP, resulting in unauthorized access to critical data, limited unauthorized data modification, and partial denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) reflects network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact with lower integrity and availability impacts. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 patches across multiple products.

Successful exploitation can lead to unauthorized access to all data accessible by Siebel CRM End User, unauthorized insert, update, or delete operations on some data, and partial denial of service conditions. The vulnerability affects confidentiality, integrity, and availability of the affected system, with the highest impact on confidentiality.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers are strongly advised to apply the provided patches without delay to remediate the issue. No alternative mitigations or workarounds are specified in the advisory. Staying on actively supported versions and promptly applying Oracle patches is recommended.