CVE-2026-83217 is a vulnerability in the Oracle Siebel CRM End User product's Open UI component affecting versions 17.0 through 26.7. It allows a low privileged attacker with network access via HTTP to compromise the Siebel CRM End User, resulting in unauthorized access to critical data and unauthorized modification of some accessible data. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, with a base score of 7.1. Oracle has released a Critical Security Patch Update in September 2026 that includes fixes for this vulnerability among many others. Oracle strongly recommends applying the available patches promptly to mitigate the risk.

Successful exploitation can lead to unauthorized access to critical data and unauthorized update, insert, or delete operations on some Siebel CRM End User accessible data. The vulnerability impacts confidentiality and integrity but does not affect availability. It requires network access via HTTP and low privileges, making it relatively easy to exploit if unpatched.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers should apply the official Oracle patches without delay to remediate this issue. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches. No additional vendor mitigation instructions indicate alternative or temporary fixes.