Vulnerability in Oracle Siebel Apps - Customer Order Management (CVE-2026-83145)
Summary
Vulnerability in Oracle Siebel Apps - Customer Order Management (CVE-2026-83145). Confidential information can be exposed externally.
Original description
The description as published by the source.
Vulnerability in the Siebel Apps - Customer Order Management product of Oracle Siebel CRM (component: Order Management). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Apps - Customer Order Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel Apps - Customer Order Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel Apps - Customer Order Management accessible data as well as unauthorized access to critical data or complete access to all Siebel Apps - Customer Order Management accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).
Source: NIST National Vulnerability Database NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-83145 has been found in Oracle Siebel Apps - Customer Order Management.
Confidential information can be exposed externally. CVSS score: 8.7/10.
What to do: apply the vendor's official patched release.
If unsure, ask your IT team or search "Oracle Siebel Apps - Customer Order Management CVE-2026-83145" on the vendor's site.
CVE-2026-83145 (Oracle Siebel Apps - Customer Order Management) — CWE-284 / CVSS v3 8.7
Attack vector: remote (network-reachable)
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-284) exists in Oracle Siebel Apps - Customer Order Management.
Check the vendor advisory for the affected versions of Oracle Siebel Apps - Customer Order Management.
Severity: High (CVSS 8.7/10). Confidential information can be exposed externally.
Update to the patched release per vendor advisory.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Audit SBOM/dependencies to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
Audit SBOM/dependencies for affected components.資産台帳・SBOM・依存マニフェストで Oracle Siebel Apps - Customer Order Management を使っているサービスとバージョンを洗い出す。
-
2Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
References
- web oracle.com
- web nvd.nist.gov
- web github.com