Quick answers
- Is CVE-2026-83220 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-83220 being exploited in the wild.
- How severe is CVE-2026-83220?
- High severity, with a CVSS score of 8.1, published 15 September 2026.
- Which products and versions are affected?
- Oracle Siebel CRM Integration 23.6 to 26.7.
- Is there a fix for CVE-2026-83220?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-83220 attacked?
- It is attacked from the adjacent network, in a hosted service.
- Am I affected by CVE-2026-83220?
- Check whether you run Oracle Siebel CRM Integration at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in the Event Publish and Subscribe component of Siebel CRM Integration and allows unauthenticated attackers with adjacent network access to compromise the system. The attack vector is adjacent network (physical communication segment), requiring no user interaction or privileges, and the configuration is simple (AC:L). Successful exploitation results in high confidentiality and integrity impact—attackers can read, create, modify, or delete critical data accessible through Siebel CRM Integration. Availability is not impacted (A:N). Affected versions are 23.6 through 26.7; patch or version update status is not specified in the advisory.
Affected products
- Oracle Siebel CRM Integration 23.6 to 26.7
Timeline
- 2026-09-15: disclosed: CVE-2026-83220 published
- 2026-09-15: other: No evidence of active exploitation in the wild as of publication date