CVE-2026-83145 in Siebel Apps Customer Order Management
Summary
by MITRE • 09/16/2026
Vulnerability in the Siebel Apps - Customer Order Management product of Oracle Siebel CRM (component: Order Management). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Apps - Customer Order Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel Apps - Customer Order Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel Apps - Customer Order Management accessible data as well as unauthorized access to critical data or complete access to all Siebel Apps - Customer Order Management accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the Order Management component of Oracle Siebel CRM, specifically affecting supported versions ranging from 17.0 through 26.7. This security flaw is classified as a critical risk due to its potential for significant data compromise and unauthorized system modification. The vulnerability allows an attacker with low privileges who has network access via HTTP to exploit the weakness within the Customer Order Management product. While the initial point of entry is limited to this specific module, the nature of the defect enables a scope change, meaning that successful exploitation can lead to impacts on additional products beyond just the Order Management system. This lateral movement capability significantly increases the severity and blast radius of the attack, transforming what might appear as an isolated issue into a broader enterprise security incident.
From a technical perspective, the exploitability of this vulnerability is characterized by low complexity but requires human interaction from a user other than the attacker. This indicates that the flaw likely involves social engineering vectors or trusted context exploitation where a legitimate user must perform an action to trigger the malicious code execution or data manipulation. Despite the requirement for user interaction, the privilege level needed is minimal, allowing even unprivileged users to initiate the compromise once they are tricked into interacting with the vulnerable interface. The attack vector over HTTP suggests that this could be exploited remotely if the service is exposed to networks where low-privilege authenticated users have access, such as internal corporate networks or potentially public-facing interfaces depending on deployment configurations.
The operational impact of a successful exploit is severe, resulting in high impacts on both confidentiality and integrity while availability remains unaffected according to the CVSS 3.1 base score of 8.7. Attackers can achieve unauthorized creation, deletion, or modification access to critical data within Siebel Apps Customer Order Management. Furthermore, they may gain complete access to all accessible data associated with this module. This level of control allows for extensive data exfiltration and tampering, which could lead to financial fraud, regulatory non-compliance due to altered records, and loss of trust in the integrity of business operations managed through Siebel CRM. The ability to modify critical data implies that attackers can alter order statuses, customer information, or transactional details without detection if proper auditing is not enabled.
In terms of industry standard classifications, this vulnerability aligns with CWE-79 for Cross-Site Scripting if the human interaction involves malicious scripts, or potentially CWE-200 for Information Exposure depending on whether data leakage occurs via error messages or direct access. The requirement for user interaction places it within ATT&CK techniques related to Social Engineering and Trusted Relationship Exploitation. Specifically, it may map to T1566 Phishing if the attack relies on deceptive links or attachments that trigger the vulnerability in a browser context. If the flaw allows privilege escalation through session manipulation, it could also relate to T1078 Valid Accounts combined with lateral movement tactics due to the scope change affecting other products.
Mitigation strategies must focus on both technical controls and user awareness training. Immediate remediation should involve applying the latest security patches provided by Oracle for Siebel CRM versions 17.0 through 26.7. Until patching is feasible, network segmentation should be enforced to restrict HTTP access to low-privileged users from untrusted networks. Implementing strict input validation and output encoding on any user-facing inputs within the Order Management module can help mitigate exploitation attempts if they involve script injection or parameter tampering. Additionally, enabling comprehensive logging and monitoring for unusual data modification patterns is crucial for detecting potential breaches early. User training programs should emphasize recognizing suspicious requests that require interaction with system functions to prevent social engineering aspects of this attack from succeeding.