Vulnerability in the Siebel Apps - Financial Services product of Oracle Siebel CRM (component: Financial Accounts). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Financial Services. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel Apps - Financial Services accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel Apps - Financial Services. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

Vendors Products
Oracle
  • Siebel Apps - Financial Services

No data.

No data.

References
Link Providers
https://www.oracle.com/security-alerts/cspusep2026.html cve-icon cve-icon
History

Tue, 22 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 21 Sep 2026 23:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Remote Access Leading to Data Exposure and Denial of Service in Oracle Siebel CRM Financial Services

Mon, 21 Sep 2026 20:00:00 +0000

Type Values Removed Values Added
Title Authentication Bypass and Denial of Service via HTTP in Oracle Siebel Financial Services
Weaknesses CWE-287

Mon, 21 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-306

Sun, 20 Sep 2026 09:30:00 +0000

Type Values Removed Values Added
Title Authentication Bypass and Denial of Service via HTTP in Oracle Siebel Financial Services
Weaknesses CWE-287

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Remote Access Allows Data Exposure and Denial of Service in Oracle Siebel CRM Financial Services
Weaknesses CWE-284

Thu, 17 Sep 2026 02:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Remote Access Allows Data Exposure and Denial of Service in Oracle Siebel CRM Financial Services
Weaknesses CWE-284

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Siebel Apps - Financial Services product of Oracle Siebel CRM (component: Financial Accounts). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Financial Services. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel Apps - Financial Services accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel Apps - Financial Services. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).
First Time appeared Oracle
Oracle siebel Apps - Financial Services
CPEs cpe:2.3:a:oracle:siebel_apps_-_financial_services:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle siebel Apps - Financial Services
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'}
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published: 2026-09-15T20:04:18.165Z

Updated: 2026-09-21T16:39:25.701Z

Reserved: 2026-08-31T15:40:57.346Z

Link: CVE-2026-83197

cve-icon Vulnrichment

Updated: 2026-09-21T16:39:21.749Z

cve-icon NVD

Status : Deferred

Published: 2026-09-15T20:18:31.167

Modified: 2026-09-21T17:19:06.310

Link: CVE-2026-83197

cve-icon Redhat

No data.